CVE-2024-45607
whatsapp-api-js fails to validate message's signature
- State
- Published
- Severity
- 5.8 Medium
- Published
- Sep 12, 2024
- Updated
- Sep 12, 2024
- Reserved
- Sep 2, 2024
Description
whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. Incorrect Access Control, anyone using the post or verifyRequestSignature methods to handle messages is impacted. This vulnerability is fixed in 4.0.3.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.8 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N | GitHub_M |
Weaknesses
- CWE-347 Improper Verification of Cryptographic Signature
Affected Products
| Product | Versions |
|---|---|
whatsapp-api-jsSecreto31126 |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.