High severity7.5NVD Advisory· Published Jul 26, 2022· Updated Jun 17, 2026

CVE-2021-40180

Description

In the WeChat application 8.0.10 for Android and iOS, a mini program can obtain sensitive information from a user's address book via wx.searchContacts.

Affected products

Tencent/wechat2 versions
cpe:2.3:a:tencent:wechat:8.0.10:*:*:*:*:android:*:*+ 1 more
- cpe:2.3:a:tencent:wechat:8.0.10:*:*:*:*:android:*:*
- cpe:2.3:a:tencent:wechat:8.0.10:*:*:*:*:iphone_os:*:*
WeChat/WeChat applicationdescription
BESTICSP/Vulnerabilities-Related-to-Mini-Programs-Permissionsllm-create
Weechat/Weechatllm-fuzzy
Range: 8.0.10

Patches

Vulnerability mechanics

References

github.com/BESTICSP/Vulnerabilities-Related-to-Mini-Programs-Permissions/blob/main/WX%20applet%20contact%20permission%20vulnerability%20report.pdfnvdExploitThird Party Advisory
pan.baidu.com/s/116sAQvs1CEzCeIfpI1NZvAnvdExploitPermissions RequiredThird Party Advisory
pan.baidu.com/s/1RqMrZBruZZ4OHdnXUN5xDwnvdExploitPermissions RequiredThird Party Advisory
arxiv.org/pdf/2205.15202.pdfnvdMitigationTechnical DescriptionThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000