CVE-2024-49421 Path traversal in Quick Share Agent
Adjacent attackers can exploit a path traversal flaw in Samsung Quick Share Agent to write files to arbitrary locations on the device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-49421?
CVE-2024-49421 is a medium-severity path traversal vulnerability in Samsung Mobile Quick Share Agent, published on 3 Dec 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Path traversal in Quick Share Agent prior to version 3.5.14.47 in Android 12, 3.5.19.41 in Android 13, and 3.5.19.42 in Android 14 allows adjacent attackers to write file in arbitrary location.
Weakness: CWE-22
Which versions are affected by CVE-2024-49421?
It affects 1 product.
Products include Samsung Quick Share.
How do I fix CVE-2024-49421?
No fix has been published for CVE-2024-49421 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-49421 being exploited?
There is no known exploitation of CVE-2024-49421 in the wild and no public exploit code.
Other vulnerabilities in Samsung Mobile Quick Share Agent
- CVE-2023-42544 Missing authorization in Quick Share
- CVE-2022-39860 Information disclosure in QuickShare
- CVE-2023-21462 Information disclosure in Quick Share Agent
- CVE-2022-30745 Improper access control vulnerability in Quick Share prior to version 13.1.2.4 allows attacker to access internal files in Quick Share.
Sources
Also known as GHSA-p9xx-363j-2j36.