Ivanti Docs@Work for Android, before 2.26.0 is affected by the 'Dirty Stream' vulnerability. The application fails to properly sanitize file names, resulting in a path traversal-affiliated vulnerability. This potentially enables other malicious apps on the device to read sensitive information stored in the app root.
Metrics
Affected Vendors & Products
References
History
Mon, 12 Aug 2024 19:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Ivanti
Ivanti docs\@work |
|
Weaknesses | CWE-22 | |
CPEs | cpe:2.3:a:ivanti:docs\@work:*:*:*:*:*:android:*:* | |
Vendors & Products |
Ivanti
Ivanti docs\@work |
|
Metrics |
cvssV3_1
|
Wed, 07 Aug 2024 14:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
Wed, 07 Aug 2024 04:00:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | Ivanti Docs@Work for Android, before 2.26.0 is affected by the 'Dirty Stream' vulnerability. The application fails to properly sanitize file names, resulting in a path traversal-affiliated vulnerability. This potentially enables other malicious apps on the device to read sensitive information stored in the app root. | |
References |
| |
Metrics |
cvssV3_0
|
MITRE
Status: PUBLISHED
Assigner: hackerone
Published: 2024-08-07T03:54:46.861Z
Updated: 2024-08-07T13:23:59.791Z
Reserved: 2024-06-08T01:04:07.093Z
Link: CVE-2024-37403
Vulnrichment
Updated: 2024-08-07T13:23:55.634Z
NVD
Status : Analyzed
Published: 2024-08-07T04:17:18.653
Modified: 2024-08-12T18:55:15.890
Link: CVE-2024-37403
Redhat
No data.