Vulnerability · Published Jul 8, 2020 · Assigned by tenable
CVE-2020-5764
High 8.8
In plain English
A high-severity security flaw in MX Player Android App. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities).
Official description
MX Player Android App versions prior to v1.24.5, are vulnerable to a directory traversal vulnerability when user is using the MX Transfer feature in "Receive" mode. An attacker can exploit this by connecting to the MX Transfer session as a "sender" and sending a MessageType of "FILE_LIST" with a "name" field containing directory traversal characters (../). This will result in the file being transferred to the victim's phone, but being saved outside of the intended "/sdcard/MXshare" directory. In some instances, an attacker can achieve remote code execution by writing ".odex" and ".vdex" files in the "oat" directory of the MX Player application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | MX Player Android App | All versions prior to version v1.24.5 |
References
- https://www.tenable.com/security/research/tra-2020-41 x_refsource_MISC