What is CVE-2024-38272?

CVE-2024-38272 is a medium-severity vulnerability in Google Nearby, classified under Authentication Bypass by Capture-replay. CVSS score: 4.3/10. Published 2024-06-26.

How severe is CVE-2024-38272?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Is CVE-2024-38272 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Google Nearby

CVE-2024-38272

There exists a vulnerability in Quick Share/Nearby, where an attacker can bypass the accept file dialog on Quick Share Windows. Normally in Quick Share Windows app we can't send a file without the user accept from the receiving device if the visibility is set to everyone mode or contacts mode. We recommend upgrading to version 1.0.1724.0 of Quick Share or above

EPSS: 0.002 (11.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

Affected products

Google Nearby — versions 0

Weakness classification (CWE)

CWE-294 — Authentication Bypass by Capture-replay

Public proof-of-concept exploits

References

cve-coordination@google.com (Patch, Issue Tracking)
cve-coordination@google.com (Patch, Issue Tracking)

Frequently asked questions

What is CVE-2024-38272?: CVE-2024-38272 is a medium-severity vulnerability in Google Nearby, classified under Authentication Bypass by Capture-replay. CVSS score: 4.3/10. Published 2024-06-26.
How severe is CVE-2024-38272?: Medium severity. CVSS v3 base score is 4.3 out of 10.
Is CVE-2024-38272 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.