CVE-2024-2365
Musicshelf SHA-1 PinningTrustManager.java weak password hash
A vulnerability classified as problematic was found in Musicshelf 1.0/1.1 on Android. Affected by this vulnerability is an unknown functionality of the file io\fabric\sdk\android\services\network\PinningTrustManager.java of the component SHA-1 Handler. The manipulation leads to password hash with insufficient computational effort. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-256321 was assigned to this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Physical
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Musicshelf SHA-1 PinningTrustManager.java weak password hash
A vulnerability classified as problematic was found in Musicshelf 1.0/1.1 on Android. Affected by this vulnerability is an unknown functionality of the file io\fabric\sdk\android\services\network\PinningTrustManager.java of the component SHA-1 Handler. The manipulation leads to password hash with insufficient computational effort. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-256321 was assigned to this vulnerability.
- Record
CVE-2024-2365- CVSS 3.1
- 1.6 Low
CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N - CVSS 3.0
- 1.6 Low
CVSS:3.0/AV:P/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 0.8
AV:L/AC:H/Au:M/C:P/I:N/A:N - Weakness
- CWE-916
- Updated
- 2026-11-02
EUVDEUVD-2024-27318
A vulnerability classified as problematic was found in Musicshelf 1.0/1.1 on Android. Affected by this vulnerability is an unknown functionality of the file io\fabric\sdk\android\services\network\PinningTrustManager.java of the component SHA-1 Handler. The manipulation leads to password hash with insufficient computational effort. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-256321 was assigned to this vulnerability.
- Record
EUVD-2024-27318- CVSS 3.1
- 1.6 Low
CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cx25-cpw4-c882
A vulnerability classified as problematic was found in Musicshelf 1.0/1.1 on Android. Affected by...
A vulnerability classified as problematic was found in Musicshelf 1.0/1.1 on Android. Affected by this vulnerability is an unknown functionality of the file io\fabric\sdk\android\services\network\PinningTrustManager.java of the component SHA-1 Handler. The manipulation leads to password hash with insufficient computational effort. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-256321 was assigned to this vulnerability.
- Record
GHSA-cx25-cpw4-c882- CVSS 3.1
- 1.6 Low
CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-916
- Updated
- 2026-11-02
NVD
A vulnerability classified as problematic was found in Musicshelf 1.0/1.1 on Android. Affected by this vulnerability is an unknown functionality of the file io\fabric\sdk\android\services\network\PinningTrustManager.java of the component SHA-1 Handler. The manipulation leads to password hash with insufficient computational effort. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-256321 was assigned to this vulnerability.
- Record
CVE-2024-2365- CVSS 3.1
- 1.6 Low
CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N - CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 0.8 Low
AV:L/AC:H/Au:M/C:P/I:N/A:N - Weakness
- CWE-916
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14598-1 No score
docker-stable-24.0.9_ce-6.1 on GA media
These are all security issues fixed in the docker-stable-24.0.9_ce-6.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14598-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
docker-stableopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 24.0.9_ce-6.1 | 24.0.9_ce-6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-2365 is a low vulnerability (CVSS 1.6) in Kirillmakarov Musicshelf, published March 10, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. No source names a fixed version.
References
vuldb.com?id.256321
github.com/ctflearner/Android_Findings/blob/main/Musicshelf/Weak_Hashing_Algorithms.md
nvd.nist.gov/vuln/detail/CVE-2024-2365
suse.com/security/cve/CVE-2024-2365