CVE-2023-28646CWE-281CWE-287

App lockout in nextcloud Android app can be bypassed via thirdparty apps

Medium · published March 30, 2023

CVSS v3.1
4.4
EPSS
0%
Percentile
12.9
In the wild
Unconfirmed
What it is

Nextcloud android is an android app for interfacing with the nextcloud home server ecosystem. In versions from 3.7.0 and before 3.24.1 an attacker that has access to the unlocked physical device can bypass the Nextcloud Android Pin/passcode protection via a thirdparty app. This allows to see meta information like sharer, sharees and activity of files. It is recommended that the Nextcloud Android app is upgraded to 3.24.1. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00229 · 12.9th percentile
Weaknesses
CWE-281 · Improper Preservation of Permissions; CWE-287 · Improper Authentication
Published
2023-03-30T18:16Z
EPSS history
Timeline
  • 30 MAR 18:16Z
    App lockout in nextcloud Android app can be bypassed via thirdparty apps
    cvelistv5