CVE-2022-39210CWE-200CWE-22

Access to internal files of the Nextcloud Android app

Low · published September 16, 2022

CVSS v3.1
3.2
EPSS
0%
Percentile
22.9
In the wild
Unconfirmed
What it is

Nextcloud android is the official Android client for the Nextcloud home server platform. Internal paths to the Nextcloud Android app files are not properly protected. As a result access to internal files of the from within the Nextcloud Android app is possible. This may lead to a leak of sensitive information in some cases. It is recommended that the Nextcloud Android app is upgraded to 3.21.0. There are no known workarounds for this issue.

The record
Technical detail
CVSS v3.1
3.2 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00312 · 22.9th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2022-09-16T23:10Z
EPSS history
Timeline
  • 16 SEP 23:10Z
    Access to internal files of the Nextcloud Android app
    cvelistv5