CVE-2023-28647CWE-281CWE-287

App pin of the iOS app can be bypassed in Nextcloud iOS

Medium · published March 30, 2023

CVSS v3.1
4.4
EPSS
0%
Percentile
19.2
In the wild
Unconfirmed
What it is

Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access to an unlocked device, they may enable the integration into the iOS Files app and bypass the Nextcloud pin/password protection and gain access to a users files. It is recommended that the Nextcloud iOS app is upgraded to 4.7.0. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00278 · 19.2th percentile
Weaknesses
CWE-281 · Improper Preservation of Permissions; CWE-287 · Improper Authentication
Published
2023-03-30T18:12Z
EPSS history
Timeline
  • 30 MAR 18:12Z
    App pin of the iOS app can be bypassed in Nextcloud iOS
    cvelistv5