CVE-2019-17151: tencent wechat

Vulnerability summary

CVE-2019-17151 is a medium (CVSS 5.8) vulnerability in tencent wechat. EPSS estimates a 1.37% chance of exploitation in the next 30 days, higher than 72% of scored vulnerabilities.

Timeline

1. 07-01-2020
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

This vulnerability allows remote attackers redirect users to an external resource on affected installations of Tencent WeChat Prior to 7.0.9. User interaction is required to exploit this vulnerability in that the target must be within a chat session together with the attacker. The specific flaw exists within the parsing of a users profile. The issue lies in the failure to properly validate a users name. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-9302.

• CWE-356Missing User Interaction for Potentially Unsafe ActionThe product encounters a situation in which some of its behavior is security-critical and should be authorized by a human before progressing, but it does not properly consult with the human user or its proxy (such as UI approval dialogues or pre-set policies) to determine whether it is allowed to perform the potentially dangerous behavior.
• CWE-601URL Redirection to Untrusted SiteThe web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.