by Kastro
Paper/Archive/CVE-2020-15165

CVE-2020-15165

maxieds ChameleonMiniLiveDebugger — Potentially tampered sources on Play Store for Chameleon Mini Live Debugger

EPSS 1%CVSS 9.3
critical.is priorityof 100
42
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 70.9.709 × 2014.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Version 1.1.6-free of Chameleon Mini Live Debugger on Google Play Store may have had it's sources or permissions tampered by a malicious actor. The official maintainer of the package is recommending all users upgrade to v1.1.8 as soon as possible. For more information, review the referenced GitHub Security Advisory.

Affected

ProductAffectedFixed inSource
ChameleonMiniLiveDebugger= v1.1.6-free–CNA

Scores by source

GitHub_M (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

refgithub.com/maxieds/ChameleonMiniLiveDebugger/security/advisories/GHSA-8q77-7hq8-f7g6refplay.google.com/store/apps/details?id=com.maxieds.chameleonminilivedebugger&hl=en_US