Session version 1.17.5 allows obtaining internal application files and public
files from the user's device without the user's consent. This is possible
because the application is vulnerable to Local File Read via chat attachments.
References
| Link | Resource |
|---|---|
| https://fluidattacks.com/advisories/newman/ | Exploit Third Party Advisory |
| https://fluidattacks.com/advisories/newman/ | Exploit Third Party Advisory |
| https://github.com/oxen-io/session-android/ | Product |
| https://github.com/oxen-io/session-android/ | Product |
Configurations
History
19 May 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Session version 1.17.5 allows obtaining internal application files and public files from the user's device without the user's consent. This is possible because the application is vulnerable to Local File Read via chat attachments. |
04 Mar 2025, 12:25
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Opft session
Opft |
|
| CWE | ||
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| CPE | cpe:2.3:a:opft:session:1.17.5:*:*:*:*:android:*:* | |
| References | () https://fluidattacks.com/advisories/newman/ - Exploit, Third Party Advisory | |
| References | () https://github.com/oxen-io/session-android/ - Product |
01 Mar 2024, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-03-01 00:15
Updated : 2025-05-19 17:15
NVD link : CVE-2024-2045
Mitre link : CVE-2024-2045
JSON object : View
Products Affected
opft
- session
CWE
No CWE.