CVE-2019-18426

Katalog CVE

CVSS 8.2 · High KEV · sudah dieksploitasi EPSS 67,9%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada whatsapp. Skor CVSS 3.1 8.2 (High) menurut NVD. Masuk katalog KEV CISA pada 23 Mei 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.

Rincian

Terbit di NVD

21 Januari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

67,9% peluang dieksploitasi; lebih tinggi dari 99,3% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

WhatsApp Cross-Site Scripting Vulnerability

Masuk KEV

23 Mei 2022

Tenggat CISA

13 Juni 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.facebook.com/security/advisories/cve-2019-18426 advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-18426 pemerintah AS
• http://packetstormsecurity.com/files/157097/WhatsApp-Desktop-0.3.9308-Cross-Site-Scripting.html exploit · advisory pihak ketiga · vdb entry