ownCloud Android app vulnerable to SQL Injection
CVE-2023-23948

5.5MEDIUM

Key Information:

Vendor

Owncloud

Status
Android
Vendor
CVE Published:
13 February 2023

What is CVE-2023-23948?

The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Version 2.21.1 of the ownCloud Android app is vulnerable to SQL injection in FileContentProvider.kt. This issue can lead to information disclosure. Two databases, filelist and owncloud_database, are affected. In version 3.0, the filelist database was deprecated. However, injections affecting owncloud_database remain relevant as of version 3.0.

Affected Version(s)

Android <= 3.0

References

https://securitylab.github.com/advisories/GHSL-2022-059_G...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.