CVE-2021-22905 Information disclosure in Nextcloud Android App (com.nextcloud.client)
The Nextcloud Android app leaks user search data to a global lookup server by default, exposing sharee information to unauthorized parties.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-22905?
CVE-2021-22905 is a medium-severity vulnerability in Nextcloud Android App (com.nextcloud.client), published on 11 Jun 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Nextcloud Android App (com.nextcloud.client) before v3.16.0 is vulnerable to information disclosure due to searches for sharees being performed by default on the lookup server instead of only using the local Nextcloud server unless a global search has been explicitly chosen by the user.
Weakness: CWE-200
Which versions are affected by CVE-2021-22905?
1 open source package ship an affected version, including nextcloud. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nextcloud Bitnami | All versions | 3.16.0 |
Products include Nextcloud Nextcloud.
How do I fix CVE-2021-22905?
Upgrade nextcloud to 3.16.0 or later.
Is CVE-2021-22905 being exploited?
There is no known exploitation of CVE-2021-22905 in the wild and no public exploit code.
Other vulnerabilities in Nextcloud Android App (com.nextcloud.client)
- CVE-2019-5454 SQL injection in com.nextcloud.client
- CVE-2021-43863 SQL Injection in FileContentProvider (GHSL-2021-1007)
- CVE-2019-5450 Cross-site scripting in com.nextcloud.client
- CVE-2019-5455 Auth bypass in com.nextcloud.client
- CVE-2021-22912 Information disclosure in Nextcloud iOS app (it.twsweb.Nextcloud)
Sources
Also known as BIT-nextcloud-2021-22905, GHSA-22v9-q3r6-x7cj.