Vulnerability · Published Oct 6, 2020 · Assigned by facebook
CVE-2020-1902
High 7.5
In plain English
A high-severity information exposure in WhatsApp Business for Android from Facebook. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS NVD)7.5High
Exploit odds (30 days)0.7%top 48.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A user running a quick search on a highly forwarded message on WhatsApp for Android from v2.20.108 to v2.20.140 or WhatsApp Business for Android from v2.20.35 to v2.20.49 could have been sent to the Google service over plain HTTP.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WhatsApp for Android | 2.20.140unspecified – before 2.20.140 | |
| WhatsApp Business for Android | 2.20.49unspecified – before 2.20.49 |
Weakness: CWE-200
References
- https://www.whatsapp.com/security/advisories/2020/ x_refsource_CONFIRM