PT-2022-19421 · Nextcloud · Nextcloud Android App

Geekysherlock · Published 2022-05-20 · Updated 2023-07-21 · CVE-2022-29160

Positive Technologies (AI Summary)

CVSS v3.1

2.8

Low

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Android versions prior to 3.19.0

Description The issue concerns the existence of sensitive tokens, images, and user-related details after the deletion of a user account in Nextcloud Android. This could lead to the misuse of the former account holder's information.

Recommendations For versions prior to 3.19.0, update to version 3.19.0 to resolve the issue. As a temporary workaround, consider restricting access to sensitive information until the update is applied.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

CWE-459

Related Identifiers

CVE-2022-29160

GHSA-XCJ9-3JCH-QR2R

Affected Products

Nextcloud Android App

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29160.json · Exploit
• 🔥 https://hackerone.com/reports/1222873 · Exploit
• https://github.com/nextcloud/android/pull/9644 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-29160 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29160 · Vendor Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xcj9-3jch-qr2r · Note
• https://t.me/cibsecurity/43069 · Telegram Post
• https://t.me/cvenotify/31010 · Telegram Post