CVE-2024-37403

Ivanti Docs@Work for Android, before 2.26.0 is affected by the 'Dirty Stream' vulnerability. The application fails to properly sanitize file names, resulting in a path traversal-affiliated vulnerability. This potentially enables other malicious apps on the device to read sensitive information stored in the app root.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://forums.ivanti.com/s/article/Security-Advisory-CVE-2024-37403-Dirty-Stream-for-Ivanti-Docs-Work-for-Android	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ivanti:docs\@work:*:*:*:*:*:android:*:*

History

25 Mar 2025, 17:15

Type	Values Removed	Values Added
CWE		CWE-24

Information

Published : 2024-08-07 04:17

Updated : 2025-03-25 17:15

NVD link : CVE-2024-37403

Mitre link : CVE-2024-37403

CVE.ORG link : CVE-2024-37403

JSON object : View

Products Affected

ivanti

docs\@work

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-24

Path Traversal: '../filedir'

{"id": "CVE-2024-37403", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "support@hackerone.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.3}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2024-08-07T04:17:18.653", "references": [{"url": "https://forums.ivanti.com/s/article/Security-Advisory-CVE-2024-37403-Dirty-Stream-for-Ivanti-Docs-Work-for-Android", "tags": ["Vendor Advisory"], "source": "support@hackerone.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-24"}]}], "descriptions": [{"lang": "en", "value": "Ivanti Docs@Work for Android, before 2.26.0 is affected by the 'Dirty Stream' vulnerability. The application fails to properly sanitize file names, resulting in a path traversal-affiliated vulnerability. This potentially enables other malicious apps on the device to read sensitive information stored in the app root."}, {"lang": "es", "value": "Ivanti Docs@Work para Android, versiones anteriores a 2.26.0, se ve afectada por la vulnerabilidad 'Dirty Stream'. La aplicaci\u00f3n no puede desinfectar adecuadamente los nombres de los archivos, lo que genera una vulnerabilidad relacionada con el path traversal. Esto potencialmente permite que otras aplicaciones maliciosas en el dispositivo lean informaci\u00f3n confidencial almacenada en la ra\u00edz de la aplicaci\u00f3n."}], "lastModified": "2025-03-25T17:15:57.523", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ivanti:docs\\@work:*:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "FAC4D166-510F-4481-8A1D-77887E56908E", "versionEndExcluding": "2.26.0"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}