vulnwire
4.6med

CVE-2020-1908

Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of…

Published 6 y ago · modified 4 mo ago · JSON

CVSS
4.6
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 22%
Public exploits
0
none known

Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact with the WhatsApp application even after the phone was locked.

Exploit prediction (EPSS)

0.29% probability of exploitation in the next 30 days, higher than 22% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.14.6CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD2.02.1AV:L/AC:L/Au:N/C:N/I:P/A:N

Affected products

  • Facebook WhatsApp Business for iOS
  • Facebook WhatsApp for iOS

Classification

Weakness
  • CWE-285 Improper Authorization
  • CWE-552 Files or Directories Accessible to External Parties

References

  • whatsapp.com /security/advisories/2020/ · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.