Vulnerability · Published Apr 27, 2022 · Assigned by GitHub_M

CVE-2022-24886Exposure of Sensitive Information to an Unauthorized Actor in com.nextcloud.client

Low 2.2

In plain English

A low-severity information exposure in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)2.2Low

Exploit odds (30 days)0.4%top 66.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. In versions prior to 3.19.0, any application with notification permission can access contacts if Nextcloud has access to Contacts without applying for the Contacts permission itself. Version 3.19.0 contains a fix for this issue. There are currently no known workarounds.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	< 3.19.0

Weakness: CWE-200 · Vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5cj3-v98r-2wmq x_refsource_CONFIRM
https://github.com/nextcloud/android/pull/9726 x_refsource_MISC
https://hackerone.com/reports/1161401 x_refsource_MISC