Lucene search

[email protected]CVE-2021-40180

HistoryJul 26, 2022 - 11:15 p.m.

CVE-2021-40180

2022-07-2623:15:08

CWE-200

[email protected]

web.nvd.nist.gov

wechat

application

vulnerability

android

ios

sensitive information

address book

cve-2021-40180

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.9%

JSON

In the WeChat application 8.0.10 for Android and iOS, a mini program can obtain sensitive information from a user’s address book via wx.searchContacts.

Affected configurations

NVD

Node

tencentwechatMatch8.0.10android

tencentwechatMatch8.0.10iphone_os

CPENameOperatorVersion
tencent:wechattencent wechateq8.0.10

CPE	Name	Operator	Version
tencent:wechat	tencent wechat	eq	8.0.10

References

arxiv.org/pdf/2205.15202.pdf

github.com/BESTICSP/Vulnerabilities-Related-to-Mini-Programs-Permissions/blob/main/WX%20applet%20contact%20permission%20vulnerability%20report.pdf

pan.baidu.com/s/116sAQvs1CEzCeIfpI1NZvA

pan.baidu.com/s/1RqMrZBruZZ4OHdnXUN5xDw

Social References

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.9%

JSON

Related for CVE-2021-40180

prion1 cvelist1 nvd1