CVE-2020-24721
An issue was discovered in the GAEN (aka Google Apple Encounter Notification) protocol through...
An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-09-29, as used in COVID-19 applications on Android and iOS. It allows a user to be put in a position where he or she can be coerced into proving or disproving an exposure notification, because of the persistent state of a private framework.
Attack profile
How easy it is to exploit
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-09-29, as used in COVID-19 applications on Android and iOS. It allows a user to be put in a position where he or she can be coerced into proving or disproving an exposure notification, because of the persistent state of a private framework.
- Record
CVE-2020-24721- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - CVSS 2.0
- 3.3 Low
AV:L/AC:M/Au:N/C:P/I:P/A:N - Updated
- 2026-11-02
CVE List No score
An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-09-29, as used in COVID-19 applications on Android and iOS. It allows a user to be put in a position where he or she can be coerced into proving or disproving an exposure notification, because of the persistent state of a private framework.
- Record
CVE-2020-24721- Updated
- 2026-11-02
EUVDEUVD-2020-17432 No score
An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-09-29, as used in COVID-19 applications on Android and iOS. It allows a user to be put in a position where he or she can be coerced into proving or disproving an exposure notification, because of the persistent state of a private framework.
- Record
EUVD-2020-17432- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9pjj-6grx-8qjx No score
An issue was discovered in the GAEN (aka Google Apple Encounter Notification) protocol through...
An issue was discovered in the GAEN (aka Google Apple Encounter Notification) protocol through 2020-08-27, as used in Corona applications on Android and iOS. It allows a user to be put in a position where he or she can be coerced into proving or dis-proving an encounter notification.
- Record
GHSA-9pjj-6grx-8qjx- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-24721 is a medium vulnerability (CVSS 5.7) in Apple Exposure Notifications, published September 30, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 24th percentile. No source names a fixed version.
References
blog.google/inside-google/company-announcements/update-exposure-notifications
github.com/minvws/nl-covid19-notification-app-coordination/blob/master/CVEs/CVE-2020-24721.txt
seclists.org/fulldisclosure/2020/Sep/53
packetstormsecurity.com/files/159419/Corona-Exposure-Notifications-API-Data-Leakage.html
nvd.nist.gov/vuln/detail/CVE-2020-24721