CVE-2020-22647

An issue found in DepositGame v.1.0 allows an attacker to gain sensitive information via the GetBonusWithdraw and withdraw functions

Critical · published March 16, 2023

CVSS v3.1
9.1
EPSS
1%
Percentile
52.4
In the wild
Unconfirmed
What it is

🚨 A sneaky flaw in DepositGame v.1.0 lets attackers scoop up sensitive information with just a few clicks! 🔥 Think of it like a gamer finding a hidden cheat code that reveals sensitive game stats — all while the developers believed their security was tight. This vulnerability allows unauthorized access through the GetBonusWithdraw and withdraw functions, like a player skipping straight to the treasure chest without any obstacles. An attacker exploiting this issue could gain access to sensitive user information, potentially leading to unauthorized withdrawals and financial loss. The fallout could be absolutely devastating for both users and the platform’s reputation, as it compromises trust and security at a fundamental level.

Put simply

Think of it like a gamer finding a hidden cheat code that reveals sensitive game stats — all while the developers believed their security was tight. This vulnerability allows unauthorized access through the GetBonusWithdraw and withdraw functions, like a player skipping straight to the treasure chest without any obstacles. This vulnerability arises from insufficient validation in the GetBonusWithdraw and withdraw functions, allowing an attacker to retrieve sensitive data and execute unauthorized actions.

What to do

An attacker exploiting this issue could gain access to sensitive user information, potentially leading to unauthorized withdrawals and financial loss. The fallout could be absolutely devastating for both users and the platform’s reputation, as it compromises trust and security at a fundamental level. Update to DepositGame version 1.1 or later immediately to close this vulnerability. Additionally, implement strict permission checks within critical functions to fortify security against unauthorized access — every layer of protection counts! You've got this! Follow these steps and you'll tighten up security in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00694 · 52.4th percentile
Published
2023-03-16T00:00Z
EPSS history
Timeline
  • 16 MAR 00:00Z
    An issue found in DepositGame v.1.0 allows an attacker to gain sensitive information via the GetBonusWithdraw and withdraw functions
    cvelistv5