PT-2024-20001 · Unknown+1 · Musicshelf+1
Affan
·
Published
2024-03-10
·
Updated
2025-03-31
·
CVE-2024-2365
CVSS v3.1
4.2
Medium
| Vector | AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Musicshelf versions 1.0 through 1.1
Description
A problematic vulnerability was found in Musicshelf on Android, affecting an unknown functionality of the file iofabricsdkandroidservices
etworkPinningTrustManager.java of the component SHA-1 Handler. The manipulation leads to password hash with insufficient computational effort. It is possible to launch the attack on the physical device. The complexity of an attack is rather high, and the exploitation appears to be difficult.
Recommendations
For Musicshelf versions 1.0 through 1.1, consider restricting access to the
PinningTrustManager.java file to minimize the risk of exploitation until a patch is available.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Musicshelf
Suse