CVE-2024-45607

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-45607
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-45607.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-45607
Aliases
Published
2024-09-12T19:58:13.803Z
Modified
2026-04-02T12:19:47.752491Z
Severity
  • 5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N CVSS Calculator
Summary
whatsapp-api-js fails to validate message's signature
Details

whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. Incorrect Access Control, anyone using the post or verifyRequestSignature methods to handle messages is impacted. This vulnerability is fixed in 4.0.3.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45607.json",
    "cwe_ids": [
        "CWE-347"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/secreto31126/whatsapp-api-js

Affected ranges

Type
GIT
Repo
https://github.com/secreto31126/whatsapp-api-js
Events
Introduced
2a4236e5c468a1c5ca5b75d67985bf33ae8499db
Fixed
d67fbeaeab5dc10c1b9da9dc35ba0e4a52a45cfd

Affected versions

4.*
4.0.0
4.0.1
4.0.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-45607.json"