CVE-2020-1903

An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have resulted in an out-of-memory denial of service. This issue would have required the receiver to explicitly open the attachment if it was received from a number not in the receiver's WhatsApp contacts.

CVSS v3 5.5 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://www.whatsapp.com/security/advisories/2020/	Vendor Advisory
https://www.whatsapp.com/security/advisories/2020/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:whatsapp:whatsapp::::::iphone_os::*
	cpe:2.3:a:whatsapp:whatsapp_business::::::iphone_os::*

History

21 Nov 2024, 05:11

Type	Values Removed	Values Added
References	~~() https://www.whatsapp.com/security/advisories/2020/ - Vendor Advisory~~	() https://www.whatsapp.com/security/advisories/2020/ - Vendor Advisory

Information

Published : 2020-10-06 18:15

Updated : 2024-11-21 05:11

NVD link : CVE-2020-1903

Mitre link : CVE-2020-1903

CVE.ORG link : CVE-2020-1903

JSON object : View

Products Affected

whatsapp

whatsapp_business
whatsapp

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2020-1903", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2020-10-06T18:15:15.907", "references": [{"url": "https://www.whatsapp.com/security/advisories/2020/", "tags": ["Vendor Advisory"], "source": "cve-assign@fb.com"}, {"url": "https://www.whatsapp.com/security/advisories/2020/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cve-assign@fb.com", "description": [{"lang": "en", "value": "CWE-400"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have resulted in an out-of-memory denial of service. This issue would have required the receiver to explicitly open the attachment if it was received from a number not in the receiver's WhatsApp contacts."}, {"lang": "es", "value": "Un problema al descomprimir documentos docx, pptx y xlsx en WhatsApp para iOS anterior a versi\u00f3n v2.20.61 y WhatsApp Business para iOS anterior a versi\u00f3n v2.20.61, podr\u00eda haber resultado en una denegaci\u00f3n de servicio por falta de memoria. Este problema habr\u00eda requerido que el receptor abriera expl\u00edcitamente el archivo adjunto si se recibi\u00f3 de un n\u00famero que no estaba en los contactos de WhatsApp del receptor"}], "lastModified": "2024-11-21T05:11:34.883", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "51FFA80F-58E2-4EBB-9815-6DFCFABE6F6A", "versionEndExcluding": "2.20.61"}, {"criteria": "cpe:2.3:a:whatsapp:whatsapp_business:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "73A2E8EB-9428-48E6-AB28-3B3A3FD838EF", "versionEndExcluding": "2.20.61"}], "operator": "OR"}]}], "sourceIdentifier": "cve-assign@fb.com"}