CVE-2024-38272

Auth Bypass in Quick Share

CVSS 7.1 HIGHEPSS 0.2%CWE-294

There exists a vulnerability in Quick Share/Nearby, where an attacker can bypass the accept file dialog on Quick Share Windows. Normally in Quick Share Windows app we can't send a file without the user accept from the receiving device if the visibility is set to everyone mode or contacts mode. We recommend upgrading to version 1.0.1724.0 of Quick Share or above

CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L

Affected products

Google · Nearby

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/google/nearby/pull/2402 https://github.com/google/nearby/pull/2589