CVE-2021-40180

· HIGHModified

← All CVEs

CVSS v3.1

7.5

EPSS

1.32%

Published

Jul 26, 2022

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

In the WeChat application 8.0.10 for Android and iOS, a mini program can obtain sensitive information from a user's address book via wx.searchContacts.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-200

Affected Products (2)

tencent · wechatvulnerable

References (8)

https://arxiv.org/pdf/2205.15202.pdf

MitigationTechnical DescriptionThird Party Advisory

https://github.com/BESTICSP/Vulnerabilities-Related-to-Mini-Programs-Permissions/blob/main/WX%20applet%20contact%20permission%20vulnerability%20report.pdf

ExploitThird Party Advisory

https://pan.baidu.com/s/116sAQvs1CEzCeIfpI1NZvA

ExploitPermissions RequiredThird Party Advisory

https://pan.baidu.com/s/1RqMrZBruZZ4OHdnXUN5xDw

ExploitPermissions RequiredThird Party Advisory

https://arxiv.org/pdf/2205.15202.pdf

MitigationTechnical DescriptionThird Party Advisory

https://github.com/BESTICSP/Vulnerabilities-Related-to-Mini-Programs-Permissions/blob/main/WX%20applet%20contact%20permission%20vulnerability%20report.pdf

ExploitThird Party Advisory

https://pan.baidu.com/s/116sAQvs1CEzCeIfpI1NZvA

ExploitPermissions RequiredThird Party Advisory

https://pan.baidu.com/s/1RqMrZBruZZ4OHdnXUN5xDw

ExploitPermissions RequiredThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs