PT-2021-19862 · Nextcloud · Nextcloud Android App

Wester0X01 · Published 2021-06-17 · Updated 2022-10-25 · CVE-2021-32695

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Android app versions prior to 3.16.1

Description The Nextcloud Android app is vulnerable to an issue where a malicious app on the same device could access the shared preferences of the Nextcloud Android application. This requires user-interaction, as the victim must initiate the sharing flow and choose the malicious app. The shared preferences contain limited private data, such as push tokens and the account name.

Recommendations For versions prior to 3.16.1, update to version 3.16.1 to resolve the issue. As a temporary workaround, consider restricting the sharing flow to trusted apps until the update is applied.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-32695

GHSA-25M9-CF6C-QF2C

Affected Products

Nextcloud Android App

References · 9

• 🔥 https://hackerone.com/reports/1142918 · Exploit
• https://github.com/nextcloud/android/pull/8433 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-32695 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32695 · Vendor Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-25m9-cf6c-qf2c · Note
• https://t.me/cvenotify/16528 · Telegram Post
• https://t.me/cvenotify/16527 · Telegram Post
• https://t.me/cibsecurity/25536 · Telegram Post
• https://t.me/cvenotify/16577 · Telegram Post