CVE-2017-8769
First published: Thu May 18 2017(Updated: )
** DISPUTED ** Facebook WhatsApp Messenger before 2.16.323 for Android uses the SD card for cleartext storage of files (Audio, Documents, Images, Video, and Voice Notes) associated with a chat, even after that chat is deleted. There may be users who expect file deletion to occur upon chat deletion, or who expect encryption (consistent with the application's use of an encrypted database to store chat text). NOTE: the vendor reportedly indicates that they do not "consider these to be security issues" because a user may legitimately want to preserve any file for use "in other apps like the Google Photos gallery" regardless of whether its associated chat is deleted.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| <2.16.323 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-8769?
CVE-2017-8769 is considered to have a moderate severity level due to potential privacy implications.
How do I fix CVE-2017-8769?
To mitigate CVE-2017-8769, users should update WhatsApp Messenger to version 2.16.323 or later.
What does CVE-2017-8769 affect?
CVE-2017-8769 affects WhatsApp Messenger for Android prior to version 2.16.323, specifically regarding file storage on the SD card.
What impact does CVE-2017-8769 have on user data?
CVE-2017-8769 may lead to sensitive files remaining on the SD card even after the associated chat has been deleted.
Is CVE-2017-8769 specific to any version of WhatsApp?
Yes, CVE-2017-8769 specifically impacts WhatsApp versions before 2.16.323 on Android devices.
- agent/references
- agent/type
- agent/severity
- agent/weakness
- agent/author
- agent/status
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- agent/event
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- status/disputed
- vendor/whatsapp
- canonical/whatsapp