VULNERABILITY INTELLIGENCE

CVE-2021-22565

CVSS score6.5 MEDIUM

EPSS probability0.44%

CISA KEVNot currently listed

Published2021-12-09

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Description

An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater.

Weakness classification

cve-coordination@google.com: CWE-284
nvd@nist.gov: NVD-CWE-Other

Primary references

cve-coordination@google.com — Patch, Release Notes, Third Party Advisory
cve-coordination@google.com — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Release Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory