PT-2019-19951 · Lenovo · Shareit

Publicado 2019-03-22 · Atualizado 2020-08-24 · CVE-2019-9939

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SHAREit version prior to 4.0.36

Description The issue allows a remote attacker to bypass authentication by requesting a non-existing page, which results in the application responding with a 200 status code and an empty page, and adding the requesting client device to the list of recognized devices. This can occur when the attacker is on the same network or joins public "open" Wi-Fi hotspots created by the application during file transfer initiation.

Recommendations For versions prior to 4.0.36, update to version 4.0.36 or later to resolve the issue. As a temporary workaround, consider restricting access to the Wi-Fi hotspot created by the application during file transfers to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2019-9939

Produtos afetados

Shareit

Referências · 3

• 🔥 https://blog.redforce.io/shareit-vulnerabilities-enable-unrestricted-access-to-adjacent-devices-files · Exploit
• https://osv.dev/vulnerability/CVE-2019-9939 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-9939 · Nota de Segurança