CVE-2024-2045

Session 1.17.5 - LFR via chat attachment

CVSS 5.5 MEDIUMEPSS 0.3%CWE-22

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 5.5EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

29 fev 2024Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Session version 1.17.5 allows obtaining internal application files and public files from the user's device without the user's consent. This is possible because the application is vulnerable to Local File Read via chat attachments.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Produtos afetados

Session · Session

Referências

https://fluidattacks.com/advisories/newman/https://github.com/oxen-io/session-android/