Vulnerability in Facebook Whatsapp Business For Android
CVE-2019-3566
A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who has taken over over a WhatsApp user's account to recover previously sent messages. This behavior requires independent knowledge of metadata for previous messages, which are not available publicly. This issue affects WhatsApp for Android 2.19.52 and 2.19.54 - 2.19.103, as well as WhatsApp Business for Android starting in v2.19.22 until v2.19.38.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.011 (64.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 64th percentile — 64.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.011 · newest: 0.011 · change: 0.000
Affected products
- Facebook Whatsapp Business For Android — versions 2.19.38, 2.19.22
- Facebook Whatsapp For Android — versions 2.19.104, 2.19.54, 2.19.52
- Whatsapp — versions 2.19.52
- Whatsapp Business
Weakness classification (CWE)
References
- www.facebook.com/security/advisories/cve-2019-3566 (Third Party Advisory)
Frequently asked questions
- What is CVE-2019-3566?
- CVE-2019-3566 is a medium-severity vulnerability in Facebook Whatsapp Business For Android, classified under Improper Access Control. CVSS score: 5.9/10. Published 2019-05-10.
- How severe is CVE-2019-3566?
- Medium severity. CVSS v3 base score is 5.9 out of 10.