CVE-2024-10668
- Source
- https://cve.org/CVERecord?id=CVE-2024-10668
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10668.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-10668
- Published
- 2024-11-07T15:22:24Z
- Modified
- 2026-10-08T07:05:42Z
- Severity
-
- 5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:A/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/AU:N/R:U/V:D/RE:L/U:Green CVSS Calculator
- Summary
- Auth Bypass in Quickshare
- Details
-
There exists an auth bypass in Google Quickshare where an attacker can upload an unknown file type to a victim. The root cause of the vulnerability lies in the fact that when a Payload Transfer frame of type FILE is sent to Quick Share, the file that is contained in this frame is written to disk in the Downloads folder. Quickshare normally deletes unkown files, however an attacker can send two Payload transfer frames of type FILE and the same payload ID. The deletion logic will only delete the first file and not the second. We recommend upgrading past commit 5d8b9156e0c339d82d3dab0849187e8819ad92c0 or Quick Share Windows v1.0.2002.2
- Database specific
{ "cna_assigner": "Google", "cwe_ids": [ "CWE-434" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10668.json", "unresolved_ranges": [ { "extracted_events": [ { "fixed": "1.0.2002.2" } ], "source": "AFFECTED_FIELD" } ] }- References
Affected packages
Git / github.com/google/nearby
Affected ranges
- Type
- GIT
- Repo
- https://github.com/google/nearby
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10668.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "49291409367868850145480854819013661082",
"length": 1540
},
"id": "CVE-2024-10668-1e331d4d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/google/nearby/commit/5d8b9156e0c339d82d3dab0849187e8819ad92c0",
"target": {
"file": "sharing/nearby_connections_manager_impl.cc",
"function": "NearbyConnectionsManagerImpl::OnPayloadTransferUpdate"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"283536230209410083967938461702055134783",
"75789771637364630815353230255941074941",
"124024032772744777976100373007198736812",
"208924514373744560057636193394930172263",
"339186667667952566932875896786507318581",
"284638282293945216122928189712950969911",
"167755423994540835273730431735150272866",
"161761331267659312726226238261632075745",
"98684566494057555405788580003286280238",
"11198442305995099792161376846317326581",
"132049876832673117147012407540118965847",
"301811076866494667296770696802058688467",
"250499488968340566757402245449439994146",
"227706146167217854721703854025400683274",
"298772218553139351467953929192505547461",
"163908777443362931619186319976478963426",
"11198442305995099792161376846317326581",
"132049876832673117147012407540118965847",
"301811076866494667296770696802058688467",
"250499488968340566757402245449439994146",
"62312852922202130723948548322340262079",
"25956382535963795050939914516846334925",
"88764174422258341189223732569245372077",
"95928312400788228976632494427256546010",
"52654911607414598735791097487206181954",
"123921293434067249078257972039612228736"
],
"threshold": 0.9
},
"id": "CVE-2024-10668-2438b45d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/google/nearby/commit/5d8b9156e0c339d82d3dab0849187e8819ad92c0",
"target": {
"file": "sharing/nearby_connections_manager_impl_test.cc"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"160430962707807260642657728841736938159",
"273757901641955649768999092944405592234",
"269777797387920701926692234078740340828",
"15114492964241157853191278840441184125",
"262468007333073733107018318635171804280",
"180801978443203963985929884635866698277",
"144513219630781310651405799064143435945",
"197560383528484335926019117922618743940"
],
"threshold": 0.9
},
"id": "CVE-2024-10668-260eaed0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/google/nearby/commit/5d8b9156e0c339d82d3dab0849187e8819ad92c0",
"target": {
"file": "sharing/flags/generated/nearby_sharing_feature_flags.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"15444804761919420018931631571432884754",
"176084744494315075904076456519947207545",
"215750372688937427437774361029545153908",
"283659024778636930184399172190188499053",
"103670824267119683372026999327225125072",
"324656506936264699612455333879377477611",
"22323805313813519604936642211429377819",
"171033018742612387007677443360170898180"
],
"threshold": 0.9
},
"id": "CVE-2024-10668-3747f7af",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/google/nearby/commit/5d8b9156e0c339d82d3dab0849187e8819ad92c0",
"target": {
"file": "sharing/nearby_connections_manager_impl.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "155724079534136410010553190726944535356",
"length": 627
},
"id": "CVE-2024-10668-4bd5f95b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/google/nearby/commit/5d8b9156e0c339d82d3dab0849187e8819ad92c0",
"target": {
"file": "sharing/flags/generated/nearby_sharing_feature_flags.h",
"function": "GetBoolFlags"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "97927518270249582423707185784533115049",
"length": 1102
},
"id": "CVE-2024-10668-adbd9f33",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/google/nearby/commit/5d8b9156e0c339d82d3dab0849187e8819ad92c0",
"target": {
"file": "sharing/nearby_connections_manager_impl_test.cc",
"function": "TEST_F"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "9435966158206504575610332725515202001",
"length": 1046
},
"id": "CVE-2024-10668-c3765870",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/google/nearby/commit/5d8b9156e0c339d82d3dab0849187e8819ad92c0",
"target": {
"file": "sharing/nearby_connections_manager_impl_test.cc",
"function": "TEST_F"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "325765130213925009085995367486170158725",
"length": 846
},
"id": "CVE-2024-10668-cb0e9bb0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/google/nearby/commit/5d8b9156e0c339d82d3dab0849187e8819ad92c0",
"target": {
"file": "sharing/nearby_connections_manager_impl.cc",
"function": "NearbyConnectionsManagerImpl::OnEndpointFound"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "135490758780773059639770855422441782405",
"length": 307
},
"id": "CVE-2024-10668-ddebdac4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/google/nearby/commit/5d8b9156e0c339d82d3dab0849187e8819ad92c0",
"target": {
"file": "sharing/nearby_connections_manager_impl.cc",
"function": "NearbyConnectionsManagerImpl::OnPayloadReceived"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"227873317588112154223260846478635706791",
"107473115569515465003099163037114034022",
"223633936179957428033715882367382499773",
"182007727519003748185717447727956890996",
"60031104687825860618807369580407301996",
"243336605907646437423741183811119362319",
"109559221110426876976840535226023120187",
"326640618624270966236640939361373750178",
"321491787928157427418603147816971262607",
"152230032470785072796063183873127292419",
"206182766609268469544972282979789283385",
"207251033210485227834939090035272812842",
"103750569534501590866656357713642523048",
"281587302061963748313077717916581128342",
"263280066068759756331144809987594788919",
"23305018402286075853772721503404179802",
"155538603221906188984226504827570497267",
"16058468592396054170815159919168866234",
"17014126218098012449651213248981836158",
"266549079252528617848986647984866708134",
"175485465201907809558838819081558838000",
"64885771798218446367350852030499213692",
"119505098739074931159184320118027540699",
"207309435260881110724495962006048702720",
"291617581087682765873474107728183285621",
"4383397308328951691102387483435365675",
"106466002571508970987945596542792677745",
"161624976545566988693793408087220206706",
"36836707330946823699187133078055170272",
"291275657112648483995326470848548061002",
"98472196350447135448163001366285704623",
"15718898241592038512017653408800417419",
"265344857810831165749200462332626942355",
"293738120722134689155739434757230991964",
"264978841069685307472084366667748984047",
"233211210975837151677333963073999971809",
"269189293970639415418030340239516771362",
"77177790749306126707982218236102454341",
"96024959871433276847261173872487934674",
"339193332463092280978278477310793693035",
"60379627929313822922547505225659952538",
"225045032956242127611886902789432614192",
"188175841670943376268755830959540604478",
"253421534557797816270543137381390957554",
"164527394177461511379542618921570072634",
"157387720284065718199933790258688167906",
"110691603366961764105713376018869609742",
"320328241156713062168046065361108666074",
"126868485639139145407966302523367635828",
"178584981209367856150432554679931819475",
"274659139670558603647664762284868040606",
"43033928642632985363999036857697302284",
"110364946460497937517669740697088132116",
"210979225763292303145056173101530215671",
"113625012065400303988096310597921061995",
"138556792068388791486375863693713497418",
"169244834766655423662768146141216615671",
"225545789173460615320950736570090371860",
"89011583091294178164638875222153522802",
"136468125024171618597410984836223000188",
"324731413398133634731429229160280704492",
"333517288348224470217699695105207105188",
"108573351328004854351667735327238945581",
"141745254324397768116932965595980210359",
"91010061524037639539228461531319266673",
"254846921767456044940306902528626218902",
"332198594095100318440364805689480776507",
"237233438789025907713218307117450338078",
"254516103148922130473728400847108460122",
"76418919068119789421480181987485189394",
"174179284832745209614012714644266992859",
"274049409609907280986704009836307099340",
"248184698086841424903443007848049097668",
"215971624241369379730357727046987693063",
"316573718102882554995066455155894976780",
"78899285369901810318502706051619894523",
"62653129659518459918628311413663488165",
"225730837139578031365166830929239274285",
"191314993386173418987592550443122409292",
"16324070594759480492156457498946825991",
"279539310525515562912539604720758900533",
"52494366525252715153935259584662951308",
"109384365852078971786584585390919354535",
"229638808165010391409009358350275048151",
"26080909981022718575640226027084126778",
"10276419870129257805254011465823542186",
"58666261684933792799731736630673939496",
"319689275474912195971707858368544162080",
"97506773177618401509837949900271683582",
"246935487763403113626232725607821064266",
"116362070788521549837155200685719761623",
"25350576670223999142498791552467451022",
"164008340979980169007691877075111674426",
"325260617031664865142547730903656445955",
"112762318065248640963506046088219605694",
"295939661160326877967134996665254894",
"153435677274866793165446734465513044471",
"170469807482965492716938209314932078102",
"46296506856052530177202416159326068689",
"161690287261100679136157319954750519923",
"165237043903137572571186597033510338844",
"304155729008382933628976398377522018191",
"134690723473447954641290405012078814124",
"202727545044083328252783897340279238798",
"283839833291619000769751034243590905498",
"81577911164310508922777168304054574240",
"58400454643586252229065060631522085078",
"222408740671907814859938475798320496286",
"34476132585018781098896135201860365856",
"289339890445087027952238783702167049833",
"226761064138258484178000940999608188690",
"275519504721606401195829965951100392648",
"103512404739701103357394168415565143300",
"61952313570514783857774357242349205364",
"230976268496389594408831755572013886763",
"253918652360767333612057273757813855746",
"257962041867008559510464548924489802190",
"6319287361979254538127936116707001000",
"122015533943578103885522859638585534138",
"62670570486611021429531535104436026752",
"22533679404539993265384794455567425099",
"202206233443551337475591463371871580978",
"250069037122149835417356882880858927349",
"10932002842908847100786829505058778049",
"261518447780928470773268168699807029771",
"71422621266382134596425451428556048289",
"79258553405735279317566669991707000137",
"26206832267339343007339593542412061422",
"328184240522386946907854760640247106531",
"314906817076835288949863039345835302084",
"37465305392804405799892322724647551667",
"94534443402607665752529789035018888999",
"169400804140264044472064575908743027280",
"296250221256643005022137458474851227990",
"249791182159470002157849480096989949616",
"268841807341934729576878830105404786626"
],
"threshold": 0.9
},
"id": "CVE-2024-10668-e783ee5e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/google/nearby/commit/5d8b9156e0c339d82d3dab0849187e8819ad92c0",
"target": {
"file": "sharing/nearby_connections_manager_impl.cc"
}
}
]
vanir_signatures_modified
"2026-10-08T07:05:42Z"