Vulnerability · Published Jan 25, 2022 · Assigned by GitHub_M

CVE-2021-43863SQL Injection in FileContentProvider (GHSL-2021-1007)

High 7.5

In plain English

A high-severity SQL injection in android from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 79% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.9%top 20.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. The Nextcloud Android app uses content providers to manage its data. Prior to version 3.18.1, the providers `FileContentProvider` and `DiskLruImageCacheFileProvider` have security issues (an SQL injection, and an insufficient permission control, respectively) that allow malicious apps in the same device to access Nextcloud's data bypassing the permission control system. Users should upgrade to version 3.18.1 to receive a patch. There are no known workarounds aside from upgrading.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	android	< 3.18.1

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/nextcloud/android/security/advisories/GHSA-vjp2-f63v-w479 x_refsource_CONFIRM
https://github.com/nextcloud/android/commit/627caba60e69e223b0fc89c4cb18eaa76a95db95 x_refsource_MISC
https://hackerone.com/reports/1358597 x_refsource_MISC