CVE-2024-2364

Katalog CVE

CVSS 4.6 · Medium EPSS 0,33%

Kerentanan Exposure of Backup File to an Unauthorized Control Sphere pada kirillmakarov musicshelf. Skor CVSS 3.1 4.6 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability classified as problematic has been found in Musicshelf 1.0/1.1 on Android. Affected is an unknown function of the file androidmanifest.xml of the component Backup Handler. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256320.

Rincian

Terbit di NVD

10 Maret 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.6 (Medium), sumber NVD
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-530: Exposure of Backup File to an Unauthorized Control Sphere
CWE-552: Files or Directories Accessible to External Parties

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ctflearner/Android_Findings/blob/main/Musicshelf/Musicshelf_Manifest_issue.md exploit
• https://vuldb.com/?ctiid.256320 permissions required
• https://vuldb.com/?id.256320 permissions required