CVE-2024-38272

Auth Bypass in Quick Share

Severity Score

7.1

*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

There exists a vulnerability in Quickshare/Nearby where an attacker can bypass the accept file dialog on QuickShare Windows. Normally in QuickShare Windows app we can't send a file without the user accept from the receiving device if the visibility is set to everyone mode or contacts mode. We recommend upgrading to version 1.0.1724.0 of Quickshare or above

Existe una vulnerabilidad en Quickshare/Nearby donde un atacante puede omitir el cuadro de diálogo de aceptación de archivos en QuickShare Windows. Normalmente, en la aplicación QuickShare para Windows no podemos enviar un archivo sin que el usuario lo acepte desde el dispositivo receptor si la visibilidad está configurada en el modo todos o el modo contactos. Recomendamos actualizar a la versión 1.0.1724.0 de Quickshare o superior

There exists a vulnerability in Quick Share/Nearby, where an attacker can bypass the accept file dialog on Quick Share Windows. Normally in Quick Share Windows app we can't send a file without the user accept from the receiving device if the visibility is set to everyone mode or contacts mode. We recommend upgrading to version 1.0.1724.0 of Quick Share or above

*Credits: Or Yair and Shmuel Cohen with SafeBreach

CVSS Scores

Google Inc.v4 7.1

Attack Vector

Adjacent

Attack Complexity

High

Attack Requirements

Present

Privileges Required

Low

User Interaction

None

System

Vulnerable | Subsequent

Confidentiality

High

Integrity

Low

Availability

Low

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-06-12 CVE Reserved
2024-06-26 CVE Published
2024-08-02 CVE Updated
2024-09-25 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-294: Authentication Bypass by Capture-replay

CAPEC

CAPEC-165: File Manipulation

References (2)

URL	Tag	Source
https://github.com/google/nearby/pull/2402
https://github.com/google/nearby/pull/2589

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Google Search vendor "Google"		Near Search vendor "Google" for product "Near"				< 1.0.1724.0 Search vendor "Google" for product "Near" and version " < 1.0.1724.0"		en		Affected