Session version 1.17.5 allows obtaining internal application files and public
files from the user's device without the user's consent. This is possible
because the application is vulnerable to Local File Read via chat attachments.
References
| Link | Resource |
|---|---|
| https://fluidattacks.com/advisories/newman/ | Exploit Third Party Advisory |
| https://fluidattacks.com/advisories/newman/ | Exploit Third Party Advisory |
| https://github.com/oxen-io/session-android/ | Product |
| https://github.com/oxen-io/session-android/ | Product |
Configurations
History
19 May 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Session version 1.17.5 allows obtaining internal application files and public files from the user's device without the user's consent. This is possible because the application is vulnerable to Local File Read via chat attachments. |
04 Mar 2025, 12:25
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://fluidattacks.com/advisories/newman/ - Exploit, Third Party Advisory | |
| References | () https://github.com/oxen-io/session-android/ - Product | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| First Time |
Opft session
Opft |
|
| CWE | ||
| CPE | cpe:2.3:a:opft:session:1.17.5:*:*:*:*:android:*:* |
01 Mar 2024, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-03-01 00:15
Updated : 2025-05-19 17:15
NVD link : CVE-2024-2045
Mitre link : CVE-2024-2045
JSON object : View
Products Affected
opft
- session
CWE
No CWE.