CVE-2022-24886CWE-200

Exposure of Sensitive Information to an Unauthorized Actor in com.nextcloud.client

Low · published April 27, 2022

CVSS v3.1
2.2
EPSS
0%
Percentile
31.7
In the wild
Unconfirmed
What it is

Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. In versions prior to 3.19.0, any application with notification permission can access contacts if Nextcloud has access to Contacts without applying for the Contacts permission itself. Version 3.19.0 contains a fix for this issue. There are currently no known workarounds.

The record
Technical detail
CVSS v3.1
2.2 · LOW
Vector
CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00388 · 31.7th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2022-04-27T13:30Z
EPSS history
Timeline
  • 27 APR 13:30Z
    Exposure of Sensitive Information to an Unauthorized Actor in com.nextcloud.client
    cvelistv5