CVE-2024-38272

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-38272
There exists a vulnerability in Quick Share/Nearby, where an attacker can bypass the accept file dialog on Quick Share Windows. Normally in Quick Share Windows app we can't send a file without the user accept from the receiving device if the visibility is set to everyone mode or contacts mode. We recommend upgrading to version 1.0.1724.0 of Quick Share or above

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/google/nearby/pull/2402 Issue Tracking Patch
https://github.com/google/nearby/pull/2589 Issue Tracking Patch
https://github.com/google/nearby/pull/2402 Issue Tracking Patch
https://github.com/google/nearby/pull/2589 Issue Tracking Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:google:nearby:*:*:*:*:*:*:*:*
History

21 Nov 2024, 09:25

Type Values Removed Values Added
References () https://github.com/google/nearby/pull/2402 - Issue Tracking, Patch () https://github.com/google/nearby/pull/2402 - Issue Tracking, Patch
References () https://github.com/google/nearby/pull/2589 - Issue Tracking, Patch () https://github.com/google/nearby/pull/2589 - Issue Tracking, Patch

24 Sep 2024, 14:34

Type Values Removed Values Added
First Time Google
Google nearby
CPE cpe:2.3:a:google:nearby:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.3
References () https://github.com/google/nearby/pull/2402 - () https://github.com/google/nearby/pull/2402 - Issue Tracking, Patch
References () https://github.com/google/nearby/pull/2589 - () https://github.com/google/nearby/pull/2589 - Issue Tracking, Patch

29 Jul 2024, 22:15

Type Values Removed Values Added
Summary (en) There exists a vulnerability in Quickshare/Nearby where an attacker can bypass the accept file dialog on QuickShare Windows. Normally in QuickShare Windows app we can't send a file without the user accept from the receiving device if the visibility is set to everyone mode or contacts mode. We recommend upgrading to version 1.0.1724.0 of Quickshare or above (en) There exists a vulnerability in Quick Share/Nearby, where an attacker can bypass the accept file dialog on Quick Share Windows. Normally in Quick Share Windows app we can't send a file without the user accept from the receiving device if the visibility is set to everyone mode or contacts mode. We recommend upgrading to version 1.0.1724.0 of Quick Share or above

27 Jun 2024, 12:47

Type Values Removed Values Added
Summary
  • (es) Existe una vulnerabilidad en Quickshare/Nearby donde un atacante puede omitir el cuadro de diálogo de aceptación de archivos en QuickShare Windows. Normalmente, en la aplicación QuickShare para Windows no podemos enviar un archivo sin que el usuario lo acepte desde el dispositivo receptor si la visibilidad está configurada en el modo todos o el modo contactos. Recomendamos actualizar a la versión 1.0.1724.0 de Quickshare o superior

26 Jun 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-26 16:15

Updated : 2024-11-21 09:25

NVD link : CVE-2024-38272

Mitre link : CVE-2024-38272

CVE.ORG link : CVE-2024-38272

JSON object : View

Products Affected

google

  • nearby
CWE
CWE-294

Authentication Bypass by Capture-replay