PT-2024-18711 · Google+1 · Android 12+3

Febin Mon Saji · Published 2024-01-04 · Updated 2024-04-02 · CVE-2024-20805

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions MyFiles versions prior to SMR Jan-2024 Release 1 in Android 11 and Android 12 MyFiles version 14.5.00.21 in Android 13

Description A path traversal vulnerability in the ZipCompressor of MyFiles allows local attackers to write arbitrary files. This issue affects MyFiles in Android 11, Android 12, and a specific version in Android 13.

Recommendations For MyFiles versions prior to SMR Jan-2024 Release 1 in Android 11 and Android 12, update to a version that includes the SMR Jan-2024 Release 1 or later. For MyFiles version 14.5.00.21 in Android 13, update to a version later than 14.5.00.21. As a temporary workaround, consider restricting access to the ZipCompressor component until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-20805

Affected Products

Android 11

Android 12

Android 13

Myfiles

References · 6

• https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-20805 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-20805 · Security Note
• https://t.me/cibsecurity/74381 · Telegram Post
• https://t.me/cvenotify/66910 · Telegram Post
• https://t.me/cvenotify/75403 · Telegram Post