Bypass Lock Protection in Nextcloud Android App
CVE-2019-5453

6.1MEDIUM

Key Information:

Vendor

Nextcloud
Status
Com.nextcloud.client
Vendor
CVE Published:
30 July 2019

What is CVE-2019-5453?

The Nextcloud Android app, prior to version 3.3.0, has a security issue that allows users to bypass lock protection, potentially granting unauthorized access to sensitive files. This occurs when a user is prompted for lock protection and switches to the Nextcloud file provider, leaving the files accessible without verification. It is essential for users to update their app to ensure their data's security.

Affected Version(s)

com.nextcloud.client 3.3.0

References

https://hackerone.com/reports/331489
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.