CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49790 – App PIN code can be bypassed in Nextcloud Files iOS
https://notcve.org/view.php?id=CVE-2023-49790
The Nextcloud iOS Files app allows users of iOS to interact with Nextcloud, a self-hosted productivity platform. Prior to version 4.9.2, the application can be used without providing the 4 digit PIN code. Nextcloud iOS Files app should be upgraded to 4.9.2 to receive the patch. No known workarounds are available. La aplicación Nextcloud iOS Files permite a los usuarios de iOS interactuar con Nextcloud, una plataforma de productividad autohospedada. • https://github.com/nextcloud/ios/pull/2665 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j8g7-88vv-rggv https://hackerone.com/reports/2245437 • CWE-287: Improper Authentication •
CVSS: 6.9EPSS: 0%CPEs: 3EXPL: 1CVE-2023-28999 – Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders
https://notcve.org/view.php?id=CVE-2023-28999
Nextcloud is an open-source productivity platform. In Nextcloud Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until 3.25.0, and Nextcloud iOS app 3.0.5 until 4.8.0, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure and add new files. This issue is fixed in Nextcloud Desktop 3.8.0, Nextcloud Android 3.25.0, and Nextcloud iOS 4.8.0. No known workarounds are available. • https://ethz.ch/content/dam/ethz/special-interest/infk/inst-infsec/appliedcrypto/education/theses/report_DanieleCoppola.pdf https://github.com/nextcloud/desktop/pull/5560 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8875-wxww-3rr8 • CWE-311: Missing Encryption of Sensitive Data CWE-325: Missing Cryptographic Step •
CVSS: 4.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-28646 – App lockout in nextcloud Android app can be bypassed via thirdparty apps
https://notcve.org/view.php?id=CVE-2023-28646
Nextcloud android is an android app for interfacing with the nextcloud home server ecosystem. In versions from 3.7.0 and before 3.24.1 an attacker that has access to the unlocked physical device can bypass the Nextcloud Android Pin/passcode protection via a thirdparty app. This allows to see meta information like sharer, sharees and activity of files. It is recommended that the Nextcloud Android app is upgraded to 3.24.1. There are no known workarounds for this vulnerability. • https://github.com/nextcloud/android/pull/11242 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c3rf-94h6-vj8v • CWE-281: Improper Preservation of Permissions CWE-287: Improper Authentication •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-28647 – App pin of the iOS app can be bypassed in Nextcloud iOS
https://notcve.org/view.php?id=CVE-2023-28647
Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access to an unlocked device, they may enable the integration into the iOS Files app and bypass the Nextcloud pin/password protection and gain access to a users files. It is recommended that the Nextcloud iOS app is upgraded to 4.7.0. There are no known workarounds for this vulnerability. • https://github.com/nextcloud/ios/pull/2344 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wjgg-2v4p-2gq6 • CWE-281: Improper Preservation of Permissions CWE-287: Improper Authentication •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-39210 – Access to internal files of the Nextcloud Android app
https://notcve.org/view.php?id=CVE-2022-39210
Nextcloud android is the official Android client for the Nextcloud home server platform. Internal paths to the Nextcloud Android app files are not properly protected. As a result access to internal files of the from within the Nextcloud Android app is possible. This may lead to a leak of sensitive information in some cases. It is recommended that the Nextcloud Android app is upgraded to 3.21.0. • https://github.com/nextcloud/android/pull/10544 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vw2w-gpcv-v39f • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •