CVE-2021-22912 Information disclosure in Nextcloud iOS app (it.twsweb.Nextcloud)
Nextcloud iOS app leaks user data by querying a global lookup server during sharee searches instead of restricting to the local server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-22912?
CVE-2021-22912 is a medium-severity vulnerability in Nextcloud iOS app (it.twsweb.Nextcloud), published on 11 Jun 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Nextcloud iOS before 3.4.2 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only on the local Nextcloud server unless a global search has been explicitly chosen by the user.
Weakness: CWE-200
Which versions are affected by CVE-2021-22912?
1 open source package ship an affected version, including nextcloud. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nextcloud Bitnami | All versions | 3.4.2 |
Products include Nextcloud Nextcloud.
How do I fix CVE-2021-22912?
Upgrade nextcloud to 3.4.2 or later.
Is CVE-2021-22912 being exploited?
There is no known exploitation of CVE-2021-22912 in the wild and no public exploit code.
Other vulnerabilities in Nextcloud iOS app (it.twsweb.Nextcloud)
- CVE-2019-5454 SQL injection in com.nextcloud.client
- CVE-2021-43863 SQL Injection in FileContentProvider (GHSL-2021-1007)
- CVE-2019-5450 Cross-site scripting in com.nextcloud.client
- CVE-2019-5455 Auth bypass in com.nextcloud.client
- CVE-2021-22905 Information disclosure in Nextcloud Android App (com.nextcloud.client)
Sources
Also known as BIT-nextcloud-2021-22912, GHSA-m7w4-cvjr-76mh.