CVE-2020-25204

The God Kings application 0.60.1 for Android exposes a broadcast receiver to other apps called com.innogames.core.frontend.notifications.receivers.LocalNotificationBroadcastReceiver. The purpose of this broadcast receiver is to show an in-game push notification to the player. However, the application does not enforce any authorization schema on the broadcast receiver, allowing any application to send fully customizable in-game push notifications.

CVSS v3.1

5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CVSS v2.0

2.1 LOWAV:L/AC:L/Au:N/C:N/I:P/A:N

EPSS

0.40% chance of exploitation in the next 30 days, 33th percentile

Published

2020-10-28

Updated

2024-08-04

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/159747/God-Kings-0.60.1-Notification-Spoofing.html

References

• CVE Record
• NVD entry

Related

• CVE-2020-25203
• CVE-2020-25211
• CVE-2020-25200
• CVE-2020-25213
• CVE-2020-25134
• CVE-2020-25223