PT-2017-18515 · Facebook · Whatsapp Messenger

Yakov Shafranovich · Published 2017-05-18 · Updated 2024-08-05 · CVE-2017-8769

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Facebook WhatsApp Messenger versions prior to 2.16.323 for Android

Description The application stores files associated with a chat, such as Audio, Documents, Images, Video, and Voice Notes, in cleartext on the SD card, even after the chat is deleted. This may contradict user expectations of file deletion or encryption, given the app's use of an encrypted database for chat text. The vendor does not consider this a security issue, as users may want to preserve files for use in other apps.

Recommendations For versions prior to 2.16.323, update to version 2.16.323 or later to ensure that files associated with deleted chats are handled as expected. As a temporary workaround, consider manually reviewing and deleting files stored on the SD card that are associated with deleted chats. Restrict access to the SD card to minimize the risk of unauthorized access to these files.

Exploit

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2017-8769

Affected Products

Whatsapp Messenger

References · 5

• 🔥 https://wwws.nightwatchcybersecurity.com/2017/05/17/advisory-whatsapp-for-android-privacy-issues-with-handling-of-media-files-cve-2017-8769 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-8769 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8769 · Vendor Advisory
• http://securityfocus.com/bid/100906 · Note
• https://t.me/cvenotify/89247 · Telegram Post