CVE-2024-3128
Raw vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2024-3128 is a low-severity Exposure of Backup File to an Unauthorized Control Sphere (CWE-530) vulnerability. Its CVSS base score is 2.4 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 19th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-31729
Vulnerability Data
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, has been found in Replify-Messenger 1.0 on Android. This issue affects some unknown processing of the file androidmanifest.xml of the component Backup File Handler. The manipulation leads to…
more
exposure of backup file to an unauthorized control sphere. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier VDB-258869 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: The vendor was contacted early and responded very quickly. He does not intend to maintain the app anymore and will revoke the availability in the Google Play Store.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces authorization checks on all logical access, directly stopping unauthorized actors from reaching backup files.
Explicitly restricts access to removable or backup media to authorized personnel only.
Limits privileges so that only the minimal set of users can access backup locations or archives.
Requires physical and logical controls plus encryption or access restrictions when storing backup media.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Explicit requirement to protect backups directly mitigates unauthorized exposure of backup files.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Proper access-rights provisioning prevents unauthorized actors from reaching backup locations.
The backup control explicitly requires protecting backup confidentiality and integrity, directly addressing exposure risks.
Information-access-restriction rules can be applied to backup directories or archives to block unauthorized spheres.
Classification helps identify which backups need stricter handling, but does not enforce storage location or access restrictions.
Access control directly limits who can reach backup files, though it does not address how backups are created or stored.
Storage-media controls govern where and how backups are physically or logically stored, directly mitigating exposure.