{"id":"CVE-2024-49421","state":"PUBLISHED","title":"Path traversal in Quick Share Agent prior to version 3.5.14.47 in Android 12, 3.5.19.41 in Android 13, and 3.5.19.42 in Android 14 allows adjacent attackers to write file in arbitr","description":"Path traversal in Quick Share Agent prior to version 3.5.14.47 in Android 12, 3.5.19.41 in Android 13, and 3.5.19.42 in Android 14 allows adjacent attackers to write file in arbitrary location.","publishedAt":"2024-12-03T05:48:06.555Z","updatedAt":"2024-12-03T14:25:22.984Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"SamsungMobile"},"assigner":"SamsungMobile","products":["Samsung Mobile Quick Share Agent"],"affected":[{"vendor":"Samsung Mobile","product":"Quick Share Agent","defaultStatus":"affected","versions":[{"version":"3.5.14.47 in Android 12, 3.5.19.41 in Android 13, and 3.5.19.42 in Android 14","status":"unaffected"}]}],"references":["https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=12"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:56.516Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/49xxx/CVE-2024-49421.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-49421","state":"PUBLISHED","datePublished":"2024-12-03T05:48:06.555Z","dateUpdated":"2024-12-03T14:25:22.984Z","assignerShortName":"SamsungMobile","assignerOrgId":"3af57064-a867-422c-b2ad-40307b65c458","dateReserved":"2024-10-15T05:26:08.661Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Path traversal in Quick Share Agent prior to version 3.5.14.47 in Android 12, 3.5.19.41 in Android 13, and 3.5.19.42 in Android 14 allows adjacent attackers to write file in arbitrary location."}],"affected":[{"vendor":"Samsung Mobile","product":"Quick Share Agent","defaultStatus":"affected","versions":[{"version":"3.5.14.47 in Android 12, 3.5.19.41 in Android 13, and 3.5.19.42 in Android 14","status":"unaffected"}]}],"references":[{"url":"https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=12"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":4.3,"vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}],"providerMetadata":{"shortName":"SamsungMobile","orgId":"3af57064-a867-422c-b2ad-40307b65c458","dateUpdated":"2024-12-03T05:48:06.555Z"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-12-03T14:24:44.279594Z","id":"CVE-2024-49421","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-12-03T14:25:22.984Z"}}]}}}