CVE-2024-2045

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-2045

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-2045.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-2045

Published

2024-02-29T23:37:37.339Z

Modified

2026-07-15T01:49:05.570083653Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Session 1.17.5 - LFR via chat attachment

Details

Session version 1.17.5 allows obtaining internal application files and public

files from the user's device without the user's consent. This is possible

because the application is vulnerable to Local File Read via chat attachments.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/2xxx/CVE-2024-2045.json",
    "cna_assigner": "Fluid Attacks",
    "cwe_ids": [
        "CWE-22"
    ]
}

References

Affected packages

Git / github.com/oxen-io/session-android

Affected ranges

Type

GIT

Repo

https://github.com/oxen-io/session-android

Events

Introduced

bdb6e7d12b05f3e08fdd54f265dc2a8bff1de36e

Last affected

bdb6e7d12b05f3e08fdd54f265dc2a8bff1de36e

Database specific

{
    "cpe": "cpe:2.3:a:opft:session:1.17.5:*:*:*:*:android:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "1.17.5"
        },
        {
            "last_affected": "1.17.5"
        }
    ]
}

Affected versions

1.*

1.17.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-2045.json"