Vulnerability · Published Oct 6, 2020 · Assigned by facebook
CVE-2020-1905
Low 3.3
In plain English
A low-severity security flaw in WhatsApp for Android from Facebook. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Severity (CVSS NVD)3.3Low
Exploit odds (30 days)0.6%top 49.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Media ContentProvider URIs used for opening attachments in other apps were generated sequentially prior to WhatsApp for Android v2.20.185, which could have allowed a malicious third party app chosen to open the file to guess the URIs for previously opened attachments until the opener app is terminated.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WhatsApp for Android | 2.20.185unspecified – before 2.20.185 |
Weakness: CWE-340
References
- https://www.whatsapp.com/security/advisories/2020/ x_refsource_CONFIRM