Lucene search

[email protected]CVE-2024-38272

HistoryJun 26, 2024 - 4:15 p.m.

CVE-2024-38272

2024-06-2616:15:11

CWE-294

[email protected]

web.nvd.nist.gov

cve-2024-38272

auth bypass

quickshare

vulnerability

file sending

7.1 High

CVSS4

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/SC:H/VI:L/SI:L/VA:L/SA:L

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

There exists a vulnerability in Quickshare/Nearby where an attacker can bypass the accept file dialog on QuickShare Windows. Normally in QuickShare Windows app we can’t send a file without the user accept from the receiving device if the visibility is set to everyone mode or contacts mode. We recommend upgrading to version 1.0.1724.0 of Quickshare or above

Affected configurations

Vulners

Node

googlegoogle-protobufRange≤1.0.1724.0

CNA Affected

[
  {
    "collectionURL": "https://github.com/google/nearby",
    "defaultStatus": "unaffected",
    "product": "Nearby",
    "repo": "https://github.com/google/nearby",
    "vendor": "Google",
    "versions": [
      {
        "lessThan": "1.0.1724.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

References

github.com/google/nearby/pull/2402

github.com/google/nearby/pull/2589