CVE-2024-45607
Last modified
CVE-2024-45607 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. EPSS estimates a 14.12% chance of exploitation in the next 30 days.
Description
whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. Incorrect Access Control, anyone using the post or verifyRequestSignature methods to handle messages is impacted. This vulnerability is fixed in 4.0.3.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Secreto31126 | Whatsapp-Api-Js | >= 4.0.0, < 4.0.3 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-45607?
How severe is CVE-2024-45607?
How do I fix CVE-2024-45607?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-4560The Kognetiks Chatbot for WordPress plugin for WordPress is …9.8
- CVE-2024-45600Fields is a GLPI plugin that allows users to add custom fiel…7.7
- CVE-2024-45601Mesop is a Python-based UI framework designed for rapid web …7.5
- CVE-2024-45604Contao is an Open Source CMS. In affected versions authentic…4.3
- CVE-2024-45605Sentry is a developer-first error tracking and performance m…4.3
- CVE-2024-45606Sentry is a developer-first error tracking and performance m…4.3
- CVE-2024-45608GLPI is a free asset and IT management software package. An …8.8
- CVE-2024-45609GLPI is a Free Asset and IT Management Software package, Dat…6.1
- CVE-2024-4561 In WhatsUp Gold versions released before 2023.1.2 , a bli…5.3
- CVE-2024-45610GLPI is an open-source asset and IT management software pack…6.1
- CVE-2024-45611GLPI is an open-source asset and IT management software pack…5.4
- CVE-2024-45612Contao is an Open Source CMS. In affected versions an untrus…5.3
Are you affected by CVE-2024-45607?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST