CVE-2020-16990
published 2020-11-11CVE-2020-16990: Azure Sphere Information Disclosure Vulnerability Azure Sphere Information Disclosure Vulnerability
medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
1.44%
70.1th percentile
Azure Sphere Information Disclosure Vulnerability
Azure Sphere Information Disclosure Vulnerability
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | azure_sphere | >= 20.00 < publication | publication |
| msrc | azure_sphere | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
cvelistv56.2MEDIUM
vendor_msrc6.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wf5v-g4f8-4jqh: Azure Sphere Information Disclosure Vulnerability This CVE ID is unique from CVE-2020-16985
ghsa_unreviewed·2022-05-24·CVSS 6.2
CVE-2020-16990 [MEDIUM] CWE-732 GHSA-wf5v-g4f8-4jqh: Azure Sphere Information Disclosure Vulnerability This CVE ID is unique from CVE-2020-16985
Azure Sphere Information Disclosure Vulnerability This CVE ID is unique from CVE-2020-16985.
GHSA
GHSA-x775-fvv7-8cfw: Azure Sphere Information Disclosure Vulnerability This CVE ID is unique from CVE-2020-16990
ghsa_unreviewed·2022-05-24·CVSS 6.2
CVE-2020-16985 [MEDIUM] CWE-908 GHSA-x775-fvv7-8cfw: Azure Sphere Information Disclosure Vulnerability This CVE ID is unique from CVE-2020-16990
Azure Sphere Information Disclosure Vulnerability This CVE ID is unique from CVE-2020-16990.
CVEList
Azure Sphere Information Disclosure Vulnerability
cvelistv5·2020-11-11·CVSS 6.2
CVE-2020-16990 [MEDIUM] Azure Sphere Information Disclosure Vulnerability
Azure Sphere Information Disclosure Vulnerability
Azure Sphere Information Disclosure Vulnerability
Microsoft
Azure Sphere Information Disclosure Vulnerability
vendor_msrc·2020-11-10·CVSS 6.2
CVE-2020-16990 [MEDIUM] Azure Sphere Information Disclosure Vulnerability
Azure Sphere Information Disclosure Vulnerability
FAQ: Azure Sphere is running on IoT devices in my environment. How do I know if any of those devices are affected by this vulnerability?
An IoT device that is running Azure Sphere and is connected to a network is automatically updated every day. This vulnerability has already been addressed so the devices are protected from this vulnerability.
FAQ: What type of information could be disclosed by this vulnerability?
The type of information that could be disclosed if an attacker successfully exploited this vulnerability is device information like resource ids, sas tokens, user properties, and other sensitive information.
FAQ: This is the first time that a CVE has been issued against Azure Sphere. Why is that?
The Azure Sphere and MSRC bount
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-11-11
Published