PT-2019-19950 · Lenovo · Shareit

Published 2019-03-22 · Updated 2021-07-21 · CVE-2019-9938

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SHAREit version prior to 4.0.42

Description The issue allows a remote attacker, who is authenticated as a "recognized device" and is on the same network or joins public "open" Wi-Fi hotspots created by the application when file transfer is initiated, to download arbitrary files from the device. This includes sensitive data such as contacts, photos, videos, and sound clips.

Recommendations For versions prior to 4.0.42, update to version 4.0.42 or later to resolve the issue. As a temporary workaround, consider restricting the use of the file transfer feature over public Wi-Fi hotspots until the update is applied.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2019-9938

Affected Products

Shareit

References · 3

• 🔥 https://blog.redforce.io/shareit-vulnerabilities-enable-unrestricted-access-to-adjacent-devices-files · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-9938 · Security Note
• https://osv.dev/vulnerability/CVE-2019-9938 · Vendor Advisory