PT-2020-9734 · Nextcloud · Nextcloud Ios App

Published 2020-02-04 · Updated 2020-02-11 · CVE-2019-15611

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud iOS App version 2.23.0

Description The issue is related to a violation of secure design principles, causing the app to leak its login and token to other Nextcloud services. This occurs during specific actions such as searching for federated users or registering for push notifications.

Recommendations For Nextcloud iOS App version 2.23.0, update to a newer version that addresses the secure design principles violation to prevent login and token leakage.

Fix

Weakness Enumeration

CWE-657

Related Identifiers

CVE-2019-15611

Affected Products

Nextcloud Ios App

References · 4

• https://nextcloud.com/security/advisory/?id=NC-SA-2019-017 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15611 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15611 · Security Note
• https://hackerone.com/reports/672623 · Note