CVSS: 2.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-24885 – Improper Authentication in Nextcloud Android Files
https://notcve.org/view.php?id=CVE-2022-24885
Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. Prior to version 3.19.1, users can bypass a lock on the Nextcloud app on an Android device by repeatedly reopening the app. Version 3.19.1 contains a fix for the problem. There are currently no known workarounds. La aplicación Android de Nextcloud es el cliente Android para Nextcloud, una plataforma de productividad autoalojada. • https://github.com/nextcloud/android/pull/9816 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-32j4-9xf3-h2mg https://hackerone.com/reports/1450368 • CWE-287: Improper Authentication •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-41166 – Permission bypass in Nextcloud Android App
https://notcve.org/view.php?id=CVE-2021-41166
The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. An issue in versions prior to 3.17.1 may lead to sensitive information disclosure. An unauthorized app that does not have the otherwise required `MANAGE_DOCUMENTS` permission may view image thumbnails for images it does not have permission to view. Version 3.17.1 contains a patch. There are no known workarounds. • https://github.com/nextcloud/android/commit/aa47197109970b8449c4e44601eba36e3481b086 https://github.com/nextcloud/android/commit/b6ecf515b38c2d82d32743f27236534f3e03ee0c https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wrwg-jwpg-r3c4 https://hackerone.com/reports/1358597 • CWE-276: Incorrect Default Permissions •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-43863 – SQL Injection in FileContentProvider (GHSL-2021-1007)
https://notcve.org/view.php?id=CVE-2021-43863
The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. The Nextcloud Android app uses content providers to manage its data. Prior to version 3.18.1, the providers `FileContentProvider` and `DiskLruImageCacheFileProvider` have security issues (an SQL injection, and an insufficient permission control, respectively) that allow malicious apps in the same device to access Nextcloud's data bypassing the permission control system. Users should upgrade to version 3.18.1 to receive a patch. There are no known workarounds aside from upgrading. • https://github.com/nextcloud/android/commit/627caba60e69e223b0fc89c4cb18eaa76a95db95 https://github.com/nextcloud/android/security/advisories/GHSA-vjp2-f63v-w479 https://hackerone.com/reports/1358597 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-32727 – End-to-end encryption device setup did not verify public key
https://notcve.org/view.php?id=CVE-2021-32727
Nextcloud Android Client is the Android client for Nextcloud. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.16.1, the Nextcloud Android client skipped a step that involved the client checking if a private key belonged to a previously downloaded public certificate. If the Nextcloud instance served a malicious public key, the data would be encrypted for this key and thus could be accessible to a malicious actor. The vulnerability is patched in version 3.16.1. • https://github.com/nextcloud/android/pull/8438 https://github.com/nextcloud/end_to_end_encryption_rfc/blob/7f002996397faefb664019a97ebb0a1e210f64f0/RFC.md#further-devices https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5v33-r9cm-7736 https://hackerone.com/reports/1189162 • CWE-295: Improper Certificate Validation •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-32694 – Malicious Android application can crash the Nextcloud Android Client
https://notcve.org/view.php?id=CVE-2021-32694
Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.15.1, a malicious application on the same device is possible to crash the Nextcloud Android Client due to an uncaught exception. The vulnerability is patched in version 3.15.1. Una aplicación Nextcloud Android es el cliente Android para Nextcloud. En versiones anteriores a 3.15.1, una aplicación maliciosa en el mismo dispositivo puede bloquear el Nextcloud Android Client debido a una excepción no capturada. • https://github.com/nextcloud/android/pull/7919 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h2gm-m374-99vc https://hackerone.com/reports/859136 • CWE-248: Uncaught Exception •