Medium severity · published Nov 3, 2020
CVE-2020-1908
Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact with the WhatsApp…
4.6
CVSS
0.3%
EPSS
No
On KEV
Description
Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact with the WhatsApp application even after the phone was locked.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WH
Whatsapp · Whatsapp
before 2.20.100 · source: NVD
WB
Whatsapp Business · Whatsapp
before 2.20.100 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-1908
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-1908
Vendor Advisory
https://www.whatsapp.com/security/advisories/2020/
More from Whatsapp
9.8
CVE-2019-3568
WhatsApp VOIP Stack Buffer Overflow Vulnerability
8.2
CVE-2019-18426
WhatsApp Cross-Site Scripting Vulnerability
5.4
CVE-2025-55177
Meta Platforms WhatsApp Incorrect Authorization Vulnerability
9.8
CVE-2022-36934
An integer overflow in WhatsApp could result in remote code execution in an established video call
9.8
CVE-2021-24042
The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp Business for iOS prior…