Time Manipulation Vulnerability in Nextcloud Android App
CVE-2019-15615

6.1MEDIUM

Key Information:

Vendor

Nextcloud
Status
Nextcloud Android
Vendor
CVE Published:
4 February 2020

What is CVE-2019-15615?

A vulnerability exists in the Nextcloud Android App version 3.9.0 due to improper validation of system time. This flaw allows an attacker to bypass the lock protection by altering the system time to a previous date, exposing sensitive data and compromising user security. Users are advised to update to the latest version to mitigate this issue.

Affected Version(s)

Nextcloud Android 3.9.1

References

https://hackerone.com/reports/747726
x_refsource_MISC
https://nextcloud.com/security/advisory/?id=NC-SA-2020-004
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.