CVE-2020-1902 - Vulnerability Details - OpenCVE

A user running a quick search on a highly forwarded message on WhatsApp for Android from v2.20.108 to v2.20.140 or WhatsApp Business for Android from v2.20.35 to v2.20.49 could have been sent to the Google service over plain HTTP.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00151.

Key SSVC decision points have not yet been added.

Vendors	Products
Whatsapp	Whatsapp Whatsapp Business

Configuration 1 [-]

OR	cpe:2.3:a:whatsapp:whatsapp::::::android::*
	cpe:2.3:a:whatsapp:whatsapp_business::::::android::*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.whatsapp.com/security/advisories/2020/

History

No history.

MITRE

Status: PUBLISHED

Assigner: facebook

Published: 2020-10-06T17:35:25

Updated: 2024-08-04T06:53:59.913Z

Reserved: 2019-12-02T00:00:00

Link: CVE-2020-1902

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-10-06T18:15:15.627

Modified: 2024-11-21T05:11:34.770

Link: CVE-2020-1902

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "WhatsApp for Android", "vendor": "Facebook", "versions": [{"status": "affected", "version": "2.20.140"}, {"lessThan": "2.20.140", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "2.20.108", "status": "unaffected", "version": "unspecified", "versionType": "custom"}]}, {"product": "WhatsApp Business for Android", "vendor": "Facebook", "versions": [{"status": "affected", "version": "2.20.49"}, {"lessThan": "2.20.49", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "2.20.35", "status": "unaffected", "version": "unspecified", "versionType": "custom"}]}], "dateAssigned": "2020-10-06T00:00:00", "descriptions": [{"lang": "en", "value": "A user running a quick search on a highly forwarded message on WhatsApp for Android from v2.20.108 to v2.20.140 or WhatsApp Business for Android from v2.20.35 to v2.20.49 could have been sent to the Google service over plain HTTP."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-10-06T17:35:25", "orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "shortName": "facebook"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.whatsapp.com/security/advisories/2020/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve-assign@fb.com", "DATE_ASSIGNED": "2020-10-06", "ID": "CVE-2020-1902", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "WhatsApp for Android", "version": {"version_data": [{"version_affected": "!=>", "version_value": "2.20.140"}, {"version_affected": "<", "version_value": "2.20.140"}, {"version_affected": "!<", "version_value": "2.20.108"}]}}, {"product_name": "WhatsApp Business for Android", "version": {"version_data": [{"version_affected": "!=>", "version_value": "2.20.49"}, {"version_affected": "<", "version_value": "2.20.49"}, {"version_affected": "!<", "version_value": "2.20.35"}]}}]}, "vendor_name": "Facebook"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A user running a quick search on a highly forwarded message on WhatsApp for Android from v2.20.108 to v2.20.140 or WhatsApp Business for Android from v2.20.35 to v2.20.49 could have been sent to the Google service over plain HTTP."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}]}, "references": {"reference_data": [{"name": "https://www.whatsapp.com/security/advisories/2020/", "refsource": "CONFIRM", "url": "https://www.whatsapp.com/security/advisories/2020/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T06:53:59.913Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.whatsapp.com/security/advisories/2020/"}]}]}, "cveMetadata": {"assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "assignerShortName": "facebook", "cveId": "CVE-2020-1902", "datePublished": "2020-10-06T17:35:25", "dateReserved": "2019-12-02T00:00:00", "dateUpdated": "2024-08-04T06:53:59.913Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:android:*:*", "matchCriteriaId": "CA96B32C-5673-4B36-AE2C-D318744B0E25", "versionEndIncluding": "2.20.140", "versionStartIncluding": "2.20.108", "vulnerable": true}, {"criteria": "cpe:2.3:a:whatsapp:whatsapp_business:*:*:*:*:*:android:*:*", "matchCriteriaId": "D098DF3C-6EA3-470E-865C-601827ABFB35", "versionEndIncluding": "2.20.49", "versionStartIncluding": "2.20.35", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A user running a quick search on a highly forwarded message on WhatsApp for Android from v2.20.108 to v2.20.140 or WhatsApp Business for Android from v2.20.35 to v2.20.49 could have been sent to the Google service over plain HTTP."}, {"lang": "es", "value": "Un usuario que realiza una b\u00fasqueda r\u00e1pida en un mensaje altamente reenviado en WhatsApp para Android desde versiones v2.20.108 hasta v2.20.140 o WhatsApp Business para Android desde versiones v2.20.35 hasta v2.20.49, podr\u00eda haber sido enviado al servicio de Google por medio de un HTTP plano"}], "id": "CVE-2020-1902", "lastModified": "2024-11-21T05:11:34.770", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-10-06T18:15:15.627", "references": [{"source": "cve-assign@fb.com", "tags": ["Vendor Advisory"], "url": "https://www.whatsapp.com/security/advisories/2020/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.whatsapp.com/security/advisories/2020/"}], "sourceIdentifier": "cve-assign@fb.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "cve-assign@fb.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-319"}], "source": "nvd@nist.gov", "type": "Primary"}]}