CVE-2024-38272
Last modified
CVE-2024-38272 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. There exists a vulnerability in Quick Share/Nearby, where an attacker can bypass the accept file dialog on Quick Share Windows. Normally in Quick Share Windows app we can't send a file without the user accept from the receiving device if the visibility is set to everyone mode or contacts mode. We recommend upgrading to version 1.0.1724.0 of Quick Share or above. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
There exists a vulnerability in Quick Share/Nearby, where an attacker can bypass the accept file dialog on Quick Share Windows. Normally in Quick Share Windows app we can't send a file without the user accept from the receiving device if the visibility is set to everyone mode or contacts mode. We recommend upgrading to version 1.0.1724.0 of Quick Share or above
Metrics
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Nearby | < 1.0.1724.0 |
References
- https://github.com/google/nearby/pull/2402Issue Tracking, Patch
- https://github.com/google/nearby/pull/2589Issue Tracking, Patch
- https://github.com/google/nearby/pull/2402Issue Tracking, Patch
- https://github.com/google/nearby/pull/2589Issue Tracking, Patch
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-38272?
How severe is CVE-2024-38272?
How do I fix CVE-2024-38272?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-38267An improper restriction of operations within the bounds of a…4.9
- CVE-2024-38268An improper restriction of operations within the bounds of a…4.9
- CVE-2024-38269An improper restriction of operations within the bounds of a…4.9
- CVE-2024-3827The Spectra Pro plugin for WordPress is vulnerable to Stored…5.4
- CVE-2024-38270An insufficient entropy vulnerability caused by the improper…6.5
- CVE-2024-38271There exists a vulnerability in Quick Share/Nearby, where an…4.8
- CVE-2024-38273Insufficient capability checks meant it was possible for use…5.4
- CVE-2024-38274Insufficient escaping of calendar event titles resulted in a…6.1
- CVE-2024-38275The cURL wrapper in Moodle retained the original request hea…7.5
- CVE-2024-38276Incorrect CSRF token checks resulted in multiple CSRF risks.8.8
- CVE-2024-38277A unique key should be generated for a user's QR login key a…5.4
- CVE-2024-38278A vulnerability has been identified in RUGGEDCOM RMC8388 V5.…7.5
Are you affected by CVE-2024-38272?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST