Details of VAR-202110-1034

ID

VAR-202110-1034

CVE

CVE-2020-11303

TITLE

plural Qualcomm Vulnerability related to resource disclosure to the wrong area in the product

Trust: 0.8

sources: JVNDB: JVNDB-2021-013766

DESCRIPTION

Accepting AMSDU frames with mismatched destination and source address can lead to information disclosure in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking. plural Qualcomm The product contains a resource disclosure vulnerability to the wrong area.Information may be obtained

Trust: 1.71

sources: NVD: CVE-2020-11303 // JVNDB: JVNDB-2021-013766 // VULMON: CVE-2020-11303

AFFECTED PRODUCTS

vendor:	qualcomm	model:	qca6564	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8976	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd845	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca9369	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca9886	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9215	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	apq8096au	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcn3998	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca0000	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca9367	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wsa8810	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8994	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6175a	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	apq8094	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6574a	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcn3680b	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9640	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcn3615	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca1023	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	apq8053	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6174	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6595	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	csra6640	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcd9335	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6234	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wsa8815	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6696	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcd9340	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6310	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9628	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca9377	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdx20m	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	apq8009	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcd9341	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6320	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6584au	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9645	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcd9326	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6564a	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcn3980	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	ar8031	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sa6145p	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sa8155p	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sa8145p	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9310	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9250	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qcs405	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdx12	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcn3660b	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	csr6030	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sa515m	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdx20	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdx24	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	apq8092	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcn3610	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6564au	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd820	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcd9330	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca4020	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca9378a	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9607	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm8215	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6574au	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8996au	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sa8195p	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcn3990	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sa8155	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sa8150p	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6595au	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcd9360	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	wcn3999	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6584	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9650	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9655	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	apq8076	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd210	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca1990	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sa6150p	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6174a	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	csra6620	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sa6155p	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca6574	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qca9379	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8992	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9615	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9206	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sa6155	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdx55	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	apq8064au	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9626	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sd821	scope:	eq	version:	-	Trust: 1.0
vendor:	クアルコム	model:	apq8076	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	apq8094	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	csr6030	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	csra6620	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	apq8009	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	apq8092	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	ar8031	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	apq8053	scope:	-	version:	-	Trust: 0.8
vendor:	クアルコム	model:	apq8064au	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2021-013766 // NVD: CVE-2020-11303

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-11303
value:	MEDIUM
Trust: 1.0
product-security@qualcomm.com:	CVE-2020-11303
value:	HIGH
Trust: 1.0
NVD:	CVE-2020-11303
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202110-130
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2020-11303
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8

product-security@qualcomm.com:	CVE-2020-11303
baseSeverity:	HIGH
baseScore:	8.6
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	4.0
version:	3.1
Trust: 1.0
OTHER:	JVNDB-2021-013766
baseSeverity:	HIGH
baseScore:	8.6
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2021-013766 // CNNVD: CNNVD-202110-130 // NVD: CVE-2020-11303 // NVD: CVE-2020-11303

PROBLEMTYPE DATA

problemtype:	CWE-668	Trust: 1.0
problemtype:	Leakage of resources to the wrong area (CWE-668) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2021-013766 // NVD: CVE-2020-11303

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202110-130

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-202110-130

PATCH

title:	October 2021 Security Bulletin	url:	https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2021-bulletin.html	Trust: 0.8
title:	Multiple Qualcomm Product access control error vulnerability fixes	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=166719	Trust: 0.6

sources: JVNDB: JVNDB-2021-013766 // CNNVD: CNNVD-202110-130

EXTERNAL IDS

db:	NVD	id:	CVE-2020-11303	Trust: 3.3
db:	JVNDB	id:	JVNDB-2021-013766	Trust: 0.8
db:	CNNVD	id:	CNNVD-202110-130	Trust: 0.6
db:	VULMON	id:	CVE-2020-11303	Trust: 0.1

sources: VULMON: CVE-2020-11303 // JVNDB: JVNDB-2021-013766 // CNNVD: CNNVD-202110-130 // NVD: CVE-2020-11303

REFERENCES

url:	https://www.qualcomm.com/company/product-security/bulletins/october-2021-bulletin	Trust: 2.3
url:	https://nvd.nist.gov/vuln/detail/cve-2020-11303	Trust: 1.4
url:	https://device.harmonyos.com/cn/docs/security/update/security-bulletins-wearables-202111-0000001172568432	Trust: 0.6
url:	https://vigilance.fr/vulnerability/google-android-pixel-multiple-vulnerabilities-of-october-2021-36587	Trust: 0.6
url:	https://source.android.com/security/bulletin/2021-10-01	Trust: 0.6
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULMON: CVE-2020-11303 // JVNDB: JVNDB-2021-013766 // CNNVD: CNNVD-202110-130 // NVD: CVE-2020-11303

SOURCES

db:	VULMON	id:	CVE-2020-11303
db:	JVNDB	id:	JVNDB-2021-013766
db:	CNNVD	id:	CNNVD-202110-130
db:	NVD	id:	CVE-2020-11303

LAST UPDATE DATE

2024-08-14T13:53:53.094000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2020-11303	date:	2021-10-20T00:00:00
db:	JVNDB	id:	JVNDB-2021-013766	date:	2022-09-27T08:52:00
db:	CNNVD	id:	CNNVD-202110-130	date:	2021-11-29T00:00:00
db:	NVD	id:	CVE-2020-11303	date:	2021-10-26T17:43:12.777

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2020-11303	date:	2021-10-20T00:00:00
db:	JVNDB	id:	JVNDB-2021-013766	date:	2022-09-27T00:00:00
db:	CNNVD	id:	CNNVD-202110-130	date:	2021-10-04T00:00:00
db:	NVD	id:	CVE-2020-11303	date:	2021-10-20T07:15:07.200