CVE-2021-40180

2022-07-2622:36:45

mitre

www.cve.org

wechat

android

ios

sensitive information

address book

data access

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

41.9%

JSON

In the WeChat application 8.0.10 for Android and iOS, a mini program can obtain sensitive information from a user’s address book via wx.searchContacts.

References

arxiv.org/pdf/2205.15202.pdf

github.com/BESTICSP/Vulnerabilities-Related-to-Mini-Programs-Permissions/blob/main/WX%20applet%20contact%20permission%20vulnerability%20report.pdf

pan.baidu.com/s/116sAQvs1CEzCeIfpI1NZvA

pan.baidu.com/s/1RqMrZBruZZ4OHdnXUN5xDw