PT-2021-23218 · Nextcloud · Nextcloud News For Android

Atorralba + 1 · Published 2021-11-30 · Updated 2021-12-02 · CVE-2021-41256

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud News for Android versions prior to 0.9.9.63

Description The Nextcloud News for Android app has a security issue where a malicious application installed on the same device can send it an arbitrary Intent that gets reflected back, unintentionally giving read and write access to non-exported Content Providers in Nextcloud News for Android.

Recommendations For versions prior to 0.9.9.63, upgrade to version 0.9.9.63 or higher as soon as possible. As a temporary workaround, consider restricting access to the non-exported Content Providers to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2021-41256

GHSA-2Q9V-Q3CC-H9F3

Affected Products

Nextcloud News For Android

References · 7

• 🔥 https://github.com/nextcloud/news-android/blob/master/security/GHSL-2021-1033_Nextcloud_News_for_Android.md · Exploit
• https://github.com/nextcloud/news-android/security/advisories/GHSA-2q9v-q3cc-h9f3 · Patch
• https://github.com/nextcloud/news-android/commit/05449cb666059af7de2302df9d5c02997a23df85 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41256 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41256 · Vendor Advisory
• https://t.me/cibsecurity/33149 · Telegram Post
• https://t.me/cvenotify/24114 · Telegram Post