« Volver al listado

CVE-2020-5764

Estado: ModificadaAlta (8.8)—

MX Player Android App versions prior to v1.24.5, are vulnerable to a directory traversal vulnerability when user is using the MX Transfer feature in "Receive" mode. An attacker can exploit this by connecting to the MX Transfer session as a "sender" and sending a MessageType of "FILE_LIST" with a "name" field containing directory traversal characters (../). This will result in the file being transferred to the victim's phone, but being saved outside of the intended "/sdcard/MXshare" directory. In some instances, an attacker can achieve remote code execution by writing ".odex" and ".vdex" files in the "oat" directory of the MX Player application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mxplayer — MX Player

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-5764",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "ADJACENT_NETWORK",
          "vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.5,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "vulnreport@tenable.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "MX Player Android App",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to version v1.24.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-07-08T14:15:10.477",
  "references": [
    {
      "url": "https://www.tenable.com/security/research/tra-2020-41",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "vulnreport@tenable.com"
    },
    {
      "url": "https://www.tenable.com/security/research/tra-2020-41",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "MX Player Android App versions prior to v1.24.5, are vulnerable to a directory traversal vulnerability when user is using the MX Transfer feature in \"Receive\" mode. An attacker can exploit this by connecting to the MX Transfer session as a \"sender\" and sending a MessageType of \"FILE_LIST\" with a \"name\" field containing directory traversal characters (../). This will result in the file being transferred to the victim's phone, but being saved outside of the intended \"/sdcard/MXshare\" directory. In some instances, an attacker can achieve remote code execution by writing \".odex\" and \".vdex\" files in the \"oat\" directory of the MX Player application."
    },
    {
      "lang": "es",
      "value": "Las  versiones de MX Player Android App anteriores a v1.24.5, son susceptibles a una vulnerabilidad de salto de directorio cuando un usuario está usando la funcionalidad MX Transfer en modo \"Receive\". Un atacante puede explotar esto al conectarse a la sesión de MX Transfer como \"sender\" y enviando un MessageType de \"FILE_LIST\" con un campo \"name\" que contiene caracteres de salto de directorio (../). Esto resultará en que el archivo es transferido hacia el teléfono de la víctima, pero siendo guardado fuera del directorio previsto \"/sdcard /MXshare\". En algunas instancias, un atacante puede lograr una ejecución  de código remota al escribir archivos \".odex\" y \".vdex\" en el directorio \"oat\" de la aplicación MX Player"
    }
  ],
  "lastModified": "2026-06-17T03:22:11.533",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mxplayer:mx_player:*:*:*:*:*:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C8E9A810-2BAB-4A92-A231-121D804C88C2",
              "versionEndExcluding": "1.24.5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vulnreport@tenable.com"
}