CVE-2019-5453 — Authentication Bypass Using an Alternate Path or Channel in Nextcloud

CWE-288 — Authentication Bypass Using an Alternate Path or ChannelCWE-287 — Improper Authentication3 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
0.1%
top 83.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
NextcloudNextcloud Com.nextcloud.client
Timeline
PublishedJul 30
Latest updateMay 24

Description

Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protection and switching to the Nextcloud file provider.

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 0.9 | Impact: 5.2

Affected Packages2 packages

▶NVDnextcloud/nextcloud3.2.4+1

🔴Vulnerability Details

2
GHSA
GHSA-8q57-r99x-pmhc: Bypass lock protection in the Nextcloud Android app prior to version 3↗2022-05-24
▶
CVEList
CVE-2019-5453: Bypass lock protection in the Nextcloud Android app prior to version 3↗2019-07-30
▶
CVE-2019-5453 — Nextcloud vulnerability | cvebase