PT-2022-11370 · Nextcloud · Nextcloud Android App

Atorralba + 1 · Published 2022-01-26 · Updated 2022-02-02 · CVE-2021-41166

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Android app versions prior to 3.17.1

Description The issue may lead to sensitive information disclosure, allowing an unauthorized app without the required MANAGE DOCUMENTS permission to view image thumbnails for images it does not have permission to view.

Recommendations For versions prior to 3.17.1, update to version 3.17.1 to resolve the issue. As a temporary workaround, consider restricting access to sensitive images until the update is applied.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2021-41166

GHSA-WRWG-JWPG-R3C4

Affected Products

Nextcloud Android App

References · 9

• https://github.com/nextcloud/android/commit/aa47197109970b8449c4e44601eba36e3481b086 · Patch
• https://github.com/nextcloud/android/commit/b6ecf515b38c2d82d32743f27236534f3e03ee0c · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wrwg-jwpg-r3c4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41166 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41166 · Vendor Advisory
• https://t.me/cvenotify/25906 · Telegram Post
• https://t.me/cibsecurity/36364 · Telegram Post
• https://hackerone.com/reports/1358597 · Note
• https://t.me/cvenotify/25891 · Telegram Post