SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2021-24035

A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed path traversal attacks that overwrite WhatsApp files.

CRITICAL 9.1EPSS 1.13%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.13%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed path traversal attacks that overwrite WhatsApp files.

CVSS 3.1
9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS
1.13% probability · 65th percentile
CISA KEV
Not listed
Weakness
CWE-23, CWE-22
Affected
whatsapp/whatsapp · whatsapp/whatsapp business
Source
cve-assign@fb.com

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.