PT-2019-19951 · Lenovo · Shareit

Published 2019-03-22 · Updated 2020-08-24 · CVE-2019-9939

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SHAREit version prior to 4.0.36

Description The issue allows a remote attacker to bypass authentication by requesting a non-existing page, which results in the application responding with a 200 status code and an empty page, and adding the requesting client device to the list of recognized devices. This can occur when the attacker is on the same network or joins public "open" Wi-Fi hotspots created by the application during file transfer initiation.

Recommendations For versions prior to 4.0.36, update to version 4.0.36 or later to resolve the issue. As a temporary workaround, consider restricting access to the Wi-Fi hotspot created by the application during file transfers to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2019-9939

Affected Products

Shareit

References · 3

• 🔥 https://blog.redforce.io/shareit-vulnerabilities-enable-unrestricted-access-to-adjacent-devices-files · Exploit
• https://osv.dev/vulnerability/CVE-2019-9939 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9939 · Security Note