Security readout for executives and security teams
Plain-English summary
DepositGame v1.0 is reported to expose sensitive information through its GetBonusWithdraw and withdraw functions. The CVSS score is critical because the issue is described as remotely reachable, unauthenticated, low complexity, and capable of high confidentiality and integrity impact.
Executive priority
Treat as urgent for any confirmed DepositGame v1.0 deployment, especially if internet-facing or managing valuable assets. If the product is not present, no direct exposure is indicated by the supplied sources.
Technical view
CVE-2020-22647 maps to CWE-668 and affects DepositGame v1.0 per the CVE description. The provided CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. The source bundle does not identify a vendor, CPE, patch version, or confirmed fixed release.
Likely exposure
Exposure is likely limited to organizations running, integrating, or forking DepositGame v1.0. The bundle lists affected vendor and product fields as n/a, so asset discovery must rely on code, deployment, and dependency inventory rather than CPE matching.
Exploitation context
CISA KEV status is false, and the provided sources do not establish active exploitation. A public GitHub reference is listed, but the bundle does not provide enough evidence to claim exploitation in the wild.
Researcher notes
Evidence is thin: the CVE record gives high severity and function names, but no vendor, CPE, patch, or detailed root cause in the bundle. Avoid assuming broader affected products or active exploitation without additional source confirmation.
Mitigation direction
- Inventory DepositGame v1.0 deployments, forks, and integrations.
- Check the project or maintainer guidance for a fixed version or official mitigation.
- Restrict public access to affected functionality where business operations allow.
- Review dependent systems for exposed sensitive data paths.
- Prioritize replacement or code remediation if no vendor fix exists.
Validation and detection
- Search repositories and deployed artifacts for DepositGame v1.0 references.
- Confirm whether GetBonusWithdraw or withdraw functionality is reachable externally.
- Map any public endpoints or contract interfaces exposing the affected functions.
- Review logs and transaction history for unexpected sensitive-data access.
- Document whether a vendor fix or maintained upstream exists.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-668: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-22647 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Resource to Wrong Sphere
Exposure of Resource to Wrong Sphere represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.