CVE-2021-24027 — Use of Cache Containing Sensitive Information in Whatsapp FOR Android

CWE-524 — Use of Cache Containing Sensitive InformationCWE-668 — Resource Exposure5 documents4 sources
Severity
7.5HIGHNVD
EPSS
6.1%
top 9.19%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Facebook Whatsapp FOR AndroidWhatsappWhatsapp Business+1 more
Timeline
PublishedApr 6
Latest updateMay 24

Description

A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third party with access to the device’s external storage to read cached TLS material.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5facebook/whatsapp_for_androidunspecified — v2.21.4.18
▶NVDwhatsapp/whatsapp< 2.21.4.18

🔴Vulnerability Details

2
GHSA
GHSA-rr7p-xgf7-grw4: A cache configuration issue prior to WhatsApp for Android v2↗2022-05-24
▶
CVEList
CVE-2021-24027: A cache configuration issue prior to WhatsApp for Android v2↗2021-04-06
▶

🕵️Threat Intelligence

2
Qualys
WhatsApp Vulnerabilities: Automatically Discover and Remediate Using VMDR for Mobile Devices | Qualys↗2021-04-22
▶
Qualys
WhatsApp Vulnerabilities: Automatically Discover and Remediate Using VMDR for Mobile Devices↗2021-04-22
▶
CVE-2021-24027 — Whatsapp FOR Android vulnerability | cvebase