Paper/Archive/CVE-2021-24035

CVE-2021-24035

Facebook WhatsApp Business for Android — A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.…

EPSS 1%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (NVD)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 66.5.665 × 2013.3 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed path traversal attacks that overwrite WhatsApp files.

Affected

ProductAffectedFixed inSource

WhatsApp Business for Androidunspecified – < v2.21.8.13v2.21.8.13CNA

WhatsApp for Androidunspecified – < v2.21.8.13v2.21.8.13CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

refwhatsapp.com/security/advisories/2021