PT-2021-15269 · Nextcloud · Nextcloud Ios

Robottod · Published 2021-06-11 · Updated 2021-06-22 · CVE-2021-22912

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud iOS versions prior to 3.4.2

Description The issue arises when searches for sharees utilize the lookup server by default, instead of only on the local Nextcloud server, unless a global search has been explicitly chosen by the user. This leads to an information disclosure.

Recommendations For Nextcloud iOS versions prior to 3.4.2, update to version 3.4.2 or later to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-22912

GHSA-M7W4-CVJR-76MH

Affected Products

Nextcloud Ios

References · 4

• 🔥 https://hackerone.com/reports/1167919 · Exploit
• https://osv.dev/vulnerability/CVE-2021-22912 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22912 · Security Note
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m7w4-cvjr-76mh · Note