CVE-2019-5451 — Authentication Bypass Using an Alternate Path or Channel in Server

CWE-288 — Authentication Bypass Using an Alternate Path or ChannelCWE-306 — Missing Authentication for Critical Function3 documents3 sources
Severity
4.6MEDIUMNVD
EPSS
0.1%
top 78.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Nextcloud ServerNextcloud Com.nextcloud.client
Timeline
PublishedJul 30
Latest updateMay 24

Description

Bypass lock protection in the Nextcloud Android app prior to version 3.6.1 allows accessing the files when repeatedly opening and closing the app in a very short time.

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 0.9 | Impact: 3.6

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-vgrh-7g93-824h: Bypass lock protection in the Nextcloud Android app prior to version 3↗2022-05-24
▶
CVEList
CVE-2019-5451: Bypass lock protection in the Nextcloud Android app prior to version 3↗2019-07-30
▶
CVE-2019-5451 — Nextcloud Server vulnerability | cvebase