CVE-2024-38272

June 26, 2024, 4:15 p.m.

Product(s) Impacted

Quickshare

  • 1.0.1724.0 - latest

Description

There exists a vulnerability in Quickshare/Nearby where an attacker can bypass the accept file dialog on QuickShare Windows. Normally in QuickShare Windows app we can't send a file without the user accept from the receiving device if the visibility is set to everyone mode or contacts mode. We recommend upgrading to version 1.0.1724.0 of Quickshare or above

Weaknesses

CWE-294
Authentication Bypass by Capture-replay

A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

CWE ID: 294

Date

Published: June 26, 2024, 4:15 p.m.

Last Modified: June 26, 2024, 4:15 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve-coordination@google.com

References

https://github.com/google/nearby/pull/2402
cve-coordination@google.com
https://github.com/google/nearby/pull/2589
cve-coordination@google.com