Published: 06/04/2021 Updated: 15/04/2021
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Summary

A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third party with access to the device’s external storage to read cached TLS material.

Most Upvoted Vulmon Research Post

Remote exploitation of a man-in-the-disk vulnerability in WhatsApp (CVE-2021-24027) https://census-labs.com/news/2021/04/14/whatsapp-mitd-remote-exploitation-CVE-2021-24027/

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

Github Repositories

WhatsApp MitD & MitM Introduction This repository contains PoC code and tools that were developed as part of our research [01] on remotely exploiting Man-in-the-Disk (MitD) vulnerabilities on WhatsApp for Android As discussed in our blog post, the code and accompanying scripts found here, were used to exploit CVE-2020-6516 (Chrome) [02] and CVE-2021-24027 (WhatsApp) [0