1. Home
  2. CVE Database
  3. CVE-2020-12624
MEDIUM · 6.5

CVE-2020-12624

The League application before 2020-05-02 on Android sends a bearer token in an HTTP Authorization header to an arbitrary web site that hosts an external image because an OkHttp object is reused, which...

Vulnerability Description

The League application before 2020-05-02 on Android sends a bearer token in an HTTP Authorization header to an arbitrary web site that hosts an external image because an OkHttp object is reused, which allows remote attackers to hijack sessions.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
TheleagueThe League< 2020-05-02

Related Weaknesses (CWE)

CWE-459

References

FAQ

What is CVE-2020-12624?

CVE-2020-12624 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The League application before 2020-05-02 on Android sends a bearer token in an HTTP Authorization header to an arbitrary web site that hosts an external image because an OkHttp object is reused, which...

How severe is CVE-2020-12624?

CVE-2020-12624 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-12624?

Check the references section above for vendor advisories and patch information. Affected products include: Theleague The League.