Cross-Site Scripting Vulnerability in WhatsApp Desktop by Facebook
CVE-2019-11928

6.1MEDIUM

Key Information:

Vendor

Facebook

Status
WhatSAPp Desktop
Vendor
CVE Published:
3 September 2020

What is CVE-2019-11928?

An input validation flaw in WhatsApp Desktop versions prior to v0.3.4932 may allow attackers to exploit cross-site scripting (XSS) vulnerabilities. This issue can be triggered through specially crafted live location messages containing malicious links, potentially compromising the security of users who click on these links.

Affected Version(s)

WhatsApp Desktop 0.3.4932

WhatsApp Desktop < 0.3.4932

References

https://www.whatsapp.com/security/advisories/2020/
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.