CVE-2020-1908 Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact with the WhatsApp application even after the...

MediumCVSS 4.6 EPSS 0.29%

Published: 2020-11-03 21:15
Updated: 2026-06-17 06:02
Exploit status: No public exploit known

Description

Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact with the WhatsApp application even after the phone was locked.

Affected products

Product	Affected versions	Fixed in
whatsapp	< 2.20.100	2.20.100
whatsapp business	< 2.20.100	2.20.100
facebook WhatsApp Business for iOS	= 2.20.100	No fix listed
facebook WhatsApp Business for iOS	< 2.20.100	2.20.100
facebook WhatsApp for iOS	= 2.20.100	No fix listed
facebook WhatsApp for iOS	< 2.20.100	2.20.100

References

www.whatsapp.com vendor-advisory

CVSS v3.1

4.6 Medium

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector: Physical
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: None

All scores (2)

v3.1 4.6 · nvd@nist.gov
v2.0 2.1 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.29% (percentile 21.9)
CWE: CWE-285 Improper Authorization CWE-552

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.