Vulnerability · Published Jun 17, 2021 · Assigned by GitHub_M
CVE-2021-32694Malicious Android application can crash the Nextcloud Android Client
Medium 4.1
In plain English
A medium-severity security flaw in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).
Severity (CVSS 3.1)4.1Medium
Exploit odds (30 days)1.0%top 38.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.15.1, a malicious application on the same device is possible to crash the Nextcloud Android Client due to an uncaught exception. The vulnerability is patched in version 3.15.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nextcloud | security-advisories | < 3.15.1 |
Weakness: CWE-248 · Vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h2gm-m374-99vc x_refsource_CONFIRM
- https://github.com/nextcloud/android/pull/7919 x_refsource_MISC
- https://hackerone.com/reports/859136 x_refsource_MISC