CVE-2021-22565

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Google LLC	Google Exposure-notifications-verification-server	>= unspecified, < 1.1.2

References

https://github.com/google/exposure-notifications-verification-server/releases/tag/v1.1.2Patch, Release Notes, Third Party Advisory
https://github.com/google/exposure-notifications-verification-server/security/advisories/GHSA-wx8q-rgfr-cf6vThird Party Advisory
https://github.com/google/exposure-notifications-verification-server/releases/tag/v1.1.2Patch, Release Notes, Third Party Advisory
https://github.com/google/exposure-notifications-verification-server/security/advisories/GHSA-wx8q-rgfr-cf6vThird Party Advisory

Timeline

Published: Dec 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-225669.8An incorrect setting of UXN bits within mmu_flags_to_s1_pte_attr lead to privileged executable pages being mapped as executable from an unpr CVE-2021-225673.5Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be exploited to get nefariou CVE-2021-225688.8When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oau CVE-2021-225695.5An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out o CVE-2021-22574.1Vulnerability in the Oracle Storage Cloud Software Appliance product of Oracle Storage Gateway (component: Management Console). The supporte CVE-2021-225705.5Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the p CVE-2021-225715.5A local attacker could read files from some other users' SA360 reports stored in the /tmp folder during staging process before the files are CVE-2021-225725.5On unix-like systems, the system temporary directory is shared between all users on that system. The root cause is File.createTempFile creat CVE-2021-225737.3The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's p CVE-2021-22588.1Vulnerability in the Oracle Projects product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected ar CVE-2021-22598.1Vulnerability in the Oracle Payables product of Oracle E-Business Suite (component: India Localization, Results). Supported versions that ar CVE-2021-22608.1Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: iRecruitment). The supported version that is affe