What is CVE-2019-3566?

CVE-2019-3566 is a medium-severity vulnerability in Facebook Whatsapp Business For Android, classified under Improper Access Control. CVSS score: 5.9/10. Published 2019-05-10.

How severe is CVE-2019-3566?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Vulnerability in Facebook Whatsapp Business For Android

CVE-2019-3566

A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who has taken over over a WhatsApp user's account to recover previously sent messages. This behavior requires independent knowledge of metadata for previous messages, which are not available publicly. This issue affects WhatsApp for Android 2.19.52 and 2.19.54 - 2.19.103, as well as WhatsApp Business for Android starting in v2.19.22 until v2.19.38.

EPSS: 0.011 (62.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Facebook Whatsapp Business For Android — versions 2.19.38, 2.19.22
Facebook Whatsapp For Android — versions 2.19.104, 2.19.54, 2.19.52
Whatsapp — versions 2.19.52
Whatsapp Whatsapp_business

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

cve-assign@fb.com (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2019-3566?: CVE-2019-3566 is a medium-severity vulnerability in Facebook Whatsapp Business For Android, classified under Improper Access Control. CVSS score: 5.9/10. Published 2019-05-10.
How severe is CVE-2019-3566?: Medium severity. CVSS v3 base score is 5.9 out of 10.