PT-2020-15146 · Facebook · Whatsapp For Android+1

Published 2020-09-03 · Updated 2020-09-11 · CVE-2020-1890

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions WhatsApp for Android versions prior to 2.20.11 WhatsApp Business for Android versions prior to 2.20.2

Description A URL validation issue could cause the recipient of a sticker message with deliberately malformed data to load an image from a sender-controlled URL without user interaction.

Recommendations For WhatsApp for Android versions prior to 2.20.11, update to version 2.20.11 or later. For WhatsApp Business for Android versions prior to 2.20.2, update to version 2.20.2 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-1890

Affected Products

Whatsapp Business For Android

Whatsapp For Android

References · 3

• https://whatsapp.com/security/advisories/2020 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-1890 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1890 · Security Note