Today > | 5 Medium | 2 Low vulnerabilities   -   You can now download lists of IOCs here!

CVE-2024-45607

Sept. 19, 2024, 2:05 a.m.

Tags

security-advisories@github.com
CWE-347
NVD-CWE-Other
2024-09-12
CVE-2024-45607

CVSS Score

5.3 / 10

Products Impacted

Vendor Product Versions
secreto31126
  • whatsapp-api-js
  • *

Description

whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. Incorrect Access Control, anyone using the post or verifyRequestSignature methods to handle messages is impacted. This vulnerability is fixed in 4.0.3.

Weaknesses

CWE-347
Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

CWE ID: 347

Date

Published: Sept. 12, 2024, 8:15 p.m.

Last Modified: Sept. 19, 2024, 2:05 a.m.

Status : Analyzed

CVE has had analysis completed and all data associations made.

More info

Source

security-advisories@github.com

CPEs

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a secreto31126 whatsapp-api-js / / / / / node.js / /

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

Base Score
5.3
Exploitability Score
3.9
Impact Score
1.4
Base Severity
MEDIUM
CVSS Vector String

The CVSS vector string provides an in-depth view of the vulnerability metrics.

View Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/ security-advisories@github.com
https://github.com/ security-advisories@github.com
https://github.com/ security-advisories@github.com