CVE-2021-31815

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

GAEN (aka Google/Apple Exposure Notifications) through 2021-04-27 on Android allows attackers to obtain sensitive information, such as a user's location history, in-person social graph, and (sometimes) COVID-19 infection status, because Rolling Proximity Identifiers and MAC addresses are written to the Android system log, and many Android devices have applications (preinstalled by the hardware manufacturer or network operator) that read system log data and send it to third parties. NOTE: a news outlet (The Markup) states that they received a vendor response indicating that fix deployment "began several weeks ago and will be complete in the coming days."

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-319

Affected software

No affected versions have been published.

Timeline

Published
Apr 28, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-318167.5When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is writtenCVE-2021-318177.5When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is writtenCVE-2021-318184.3Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied dCVE-2021-318199.8In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already tCVE-2021-31828.0D-Link DCS-5220 devices have a buffer overflow. NOTE: This vulnerability only affects products that are no longer supported by the maintaineCVE-2021-318207.5In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown inCVE-2021-318215.5When the Windows Tentacle docker image starts up it logs all the commands that it runs along with the arguments, which writes the Octopus SeCVE-2021-318227.8When Octopus Tentacle is installed on a Linux operating system, the systemd service file permissions are misconfigured. This could lead to aCVE-2021-318267.5Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature. The flaw isCVE-2021-318278.8In Progress MOVEit Transfer before 2021.0 (13.0), a SQL injection vulnerability has been found in the MOVEit Transfer web app that could allCVE-2021-318287.1An SSRF issue in Open Distro for Elasticsearch (ODFE) before 1.13.1.0 allows an existing privileged user to enumerate listening services or CVE-2021-318295.5kernel/bpf/verifier.c in the Linux kernel through 5.12.1 performs undesirable speculative loads, leading to disclosure of stack content via
CVE-2021-31815: Low severity, CVSS 3.3 | Vulnix