PT-2019-19950 · Lenovo · Shareit

Publicado 2019-03-22 · Atualizado 2021-07-21 · CVE-2019-9938

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SHAREit version prior to 4.0.42

Description The issue allows a remote attacker, who is authenticated as a "recognized device" and is on the same network or joins public "open" Wi-Fi hotspots created by the application when file transfer is initiated, to download arbitrary files from the device. This includes sensitive data such as contacts, photos, videos, and sound clips.

Recommendations For versions prior to 4.0.42, update to version 4.0.42 or later to resolve the issue. As a temporary workaround, consider restricting the use of the file transfer feature over public Wi-Fi hotspots until the update is applied.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2019-9938

Produtos afetados

Shareit

Referências · 3

• 🔥 https://blog.redforce.io/shareit-vulnerabilities-enable-unrestricted-access-to-adjacent-devices-files · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-9938 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-9938 · Aviso do Fabricante