CVE-2023-49790 App PIN code can be bypassed in Nextcloud Files iOS
Attackers can bypass the PIN code lock in the Nextcloud iOS Files app to access protected data without authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-49790?
CVE-2023-49790 is a medium-severity authentication bypass vulnerability in nextcloud security-advisories, published on 22 Dec 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Nextcloud iOS Files app allows users of iOS to interact with Nextcloud, a self-hosted productivity platform. Prior to version 4.9.2, the application can be used without providing the 4 digit PIN code. Nextcloud iOS Files app should be upgraded to 4.9.2 to receive the patch. No known workarounds are available.
Weakness: CWE-287
Which versions are affected by CVE-2023-49790?
1 open source package ship an affected version, including nextcloud. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nextcloud Bitnami | All versions | 4.9.2 |
Products include Nextcloud Nextcloud.
How do I fix CVE-2023-49790?
Upgrade nextcloud to 4.9.2 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-49790 being exploited?
There is no known exploitation of CVE-2023-49790 in the wild and no public exploit code.
Other vulnerabilities in nextcloud security-advisories
- CVE-2019-5454 SQL injection in com.nextcloud.client
- CVE-2021-43863 SQL Injection in FileContentProvider (GHSL-2021-1007)
- CVE-2019-5450 Cross-site scripting in com.nextcloud.client
- CVE-2019-5455 Auth bypass in com.nextcloud.client
- CVE-2021-22905 Information disclosure in Nextcloud Android App (com.nextcloud.client)
Sources
Also known as BIT-nextcloud-2023-49790, GHSA-j8g7-88vv-rggv.