Vulnerability Details : CVE-2021-22905
Nextcloud Android App (com.nextcloud.client) before v3.16.0 is vulnerable to information disclosure due to searches for sharees being performed by default on the lookup server instead of only using the local Nextcloud server unless a global search has been explicitly chosen by the user.
Vulnerability category: Information leak
Exploit prediction scoring system (EPSS) score for CVE-2021-22905
Probability of exploitation activity in the next 30 days: 0.16%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 51 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2021-22905
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:N/A:N |
8.6
|
2.9
|
NIST |
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
2.8
|
3.6
|
NIST |
CWE ids for CVE-2021-22905
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by:
- nvd@nist.gov (Primary)
- support@hackerone.com (Secondary)
References for CVE-2021-22905
-
https://hackerone.com/reports/1167916
Sign inExploit;Issue Tracking;Third Party Advisory
-
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-22v9-q3r6-x7cj
Default Nextcloud Server and Android Client leak sharee searches to Nextcloud · Advisory · nextcloud/security-advisories · GitHubThird Party Advisory
Products affected by CVE-2021-22905
- cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:android:*:*