Auth Bypass in Quick Share
Key facts
- Attack vector
- Adjacent network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-294.
Summary
There exists a vulnerability in Quick Share/Nearby, where an attacker can bypass the accept file dialog on Quick Share Windows. Normally in Quick Share Windows app we can't send a file without the user accept from the receiving device if the visibility is set to everyone mode or contacts mode. We recommend upgrading to version 1.0.1724.0 of Quick Share or above
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA Nearby (Google) Fixed in 1.0.1724.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Google Nearby 1.0.1724.0
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2024-25549 Denial of Service in Quick SharePriority LOW 28
Timeline
- 2026-10-02 Threatist record created from CVE-2024-38272
- 2026-10-03 Alias added: GHSA-qf8r-gmh3-q7x2
References
More Google Nearby vulnerabilities
- TI-2024-25549 Denial of Service in Quick Share CVSS 4.0MEDIUM 5.9
Sources
- CVE-2024-38272 · CVE Program
- CVE-2024-38272 · NVD
- FIRST EPSS
- GHSA-qf8r-gmh3-q7x2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences