PT-2023-31352 · Nextcloud · Nextcloud Ios Files App

Mridulvohra · Published 2023-12-22 · Updated 2026-01-06 · CVE-2023-49790

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Nextcloud iOS Files app versions prior to 4.9.2

Description The issue affects the Nextcloud iOS Files app, which is used to interact with the Nextcloud self-hosted productivity platform. It allows the application to be used without providing the required 4-digit PIN code.

Recommendations For Nextcloud iOS Files app versions prior to 4.9.2, upgrade to version 4.9.2 to receive the patch.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-49790

GHSA-J8G7-88VV-RGGV

Affected Products

Nextcloud Ios Files App

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49790.json · Exploit
• https://github.com/nextcloud/ios/pull/2665 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j8g7-88vv-rggv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-49790 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49790 · Security Note
• https://hackerone.com/reports/2245437 · Note
• https://twitter.com/UndercodeUpdate/status/2004550821388951661 · Twitter Post
• https://twitter.com/UndercodeUpdate/status/2008388432528044206 · Twitter Post
• https://twitter.com/UndercodeUpdate/status/2003700102398116252 · Twitter Post