CVE-2024-2364

A vulnerability classified as problematic has been found in Musicshelf 1.0/1.1 on Android. Affected is an unknown function of the file androidmanifest.xml of the component Backup Handler. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256320.

CVSS v3 1.8 LOW
CVSS v2.0 1.4 LOW

1.8^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.3 / Impact : 1.4

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

1.4^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:M/C:P/I:N/A:N

Exploitability : 2.5 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication MULTIPLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/ctflearner/Android_Findings/blob/main/Musicshelf/Musicshelf_Manifest_issue.md	Exploit
https://vuldb.com/?ctiid.256320	Permissions Required
https://vuldb.com/?id.256320	Permissions Required
https://github.com/ctflearner/Android_Findings/blob/main/Musicshelf/Musicshelf_Manifest_issue.md	Exploit
https://vuldb.com/?ctiid.256320	Permissions Required
https://vuldb.com/?id.256320	Permissions Required

Configurations

Configuration 1 (hide)

cpe:2.3:a:kirillmakarov:musicshelf:1.1:*:*:*:*:android:*:*

History

No history.

Information

Published : 2024-03-10 23:15

Updated : 2025-02-27 03:19

NVD link : CVE-2024-2364

Mitre link : CVE-2024-2364

CVE.ORG link : CVE-2024-2364

JSON object : View

Products Affected

kirillmakarov

musicshelf

CWE

CWE-530

Exposure of Backup File to an Unauthorized Control Sphere

CWE-552

Files or Directories Accessible to External Parties

{"id": "CVE-2024-2364", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"version": "2.0", "baseScore": 1.4, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:M/C:P/I:N/A:N", "authentication": "MULTIPLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 2.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 1.8, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.3}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.9}]}, "published": "2024-03-10T23:15:54.423", "references": [{"url": "https://github.com/ctflearner/Android_Findings/blob/main/Musicshelf/Musicshelf_Manifest_issue.md", "tags": ["Exploit"], "source": "[email protected]"}, {"url": "https://vuldb.com/?ctiid.256320", "tags": ["Permissions Required"], "source": "[email protected]"}, {"url": "https://vuldb.com/?id.256320", "tags": ["Permissions Required"], "source": "[email protected]"}, {"url": "https://github.com/ctflearner/Android_Findings/blob/main/Musicshelf/Musicshelf_Manifest_issue.md", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://vuldb.com/?ctiid.256320", "tags": ["Permissions Required"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://vuldb.com/?id.256320", "tags": ["Permissions Required"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-530"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-552"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability classified as problematic has been found in Musicshelf 1.0/1.1 on Android. Affected is an unknown function of the file androidmanifest.xml of the component Backup Handler. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256320."}, {"lang": "es", "value": "Una vulnerabilidad ha sido encontrada en Musicshelf 1.0/1.1 en Android y clasificada como problem\u00e1tica. Una funci\u00f3n desconocida del archivo androidmanifest.xml del componente Backup Handler es afectada por esta vulnerabilidad. La manipulaci\u00f3n conduce a la exposici\u00f3n del archivo de copia de seguridad a una esfera de control no autorizada. Es posible lanzar el ataque al dispositivo f\u00edsico. El exploit ha sido divulgado al p\u00fablico y puede utilizarse. El identificador de esta vulnerabilidad es VDB-256320."}], "lastModified": "2025-02-27T03:19:37.513", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kirillmakarov:musicshelf:1.1:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "EDDA1DFD-D0ED-45D1-9774-B6E9C7F7373E"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}