PT-2016-4836 · Lenovo · Shareit

Ivan Huertas · Published 2016-01-26 · Updated 2018-10-09 · CVE-2016-1490

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Lenovo SHAREit versions prior to 3.2.0

Description The issue allows remote attackers to obtain sensitive file names via a crafted file request to the "/list" API endpoint.

Recommendations For versions prior to 3.2.0, update to version 3.2.0 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-1490

Affected Products

Shareit

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2016-1490 · Security Note
• https://osv.dev/vulnerability/CVE-2016-1490 · Vendor Advisory
• https://support.lenovo.com/us/en/product_security/len_4058 · Vendor Advisory
• http://packetstormsecurity.com/files/135378/Lenovo-ShareIT-Information-Disclosure-Hardcoded-Password.html · Note
• http://coresecurity.com/advisories/lenovo-shareit-multiple-vulnerabilities · Note
• http://seclists.org/fulldisclosure/2016/Jan/67 · Note
• http://securityfocus.com/archive/1/537365/100/0/threaded · Note