CVE-2022-24885

low-risk
Published 2022-04-27

Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. Prior to version 3.19.1, users can bypass a lock on the Nextcloud app on an Android device by repeatedly reopening the app. Version 3.19.1 contains a fix for the problem. There are currently no known workarounds.

Do I need to act?

-
0.09% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
2
CVSS 2.0/10 Low
PHYSICAL / LOW complexity

Affected Products (1)

Affected Vendors

Nextcloud

References (6)

Patch https://github.com/nextcloud/android/pull/9816
Third Party Advisory https://github.com/nextcloud/security-advisories/security/advisories/GHSA-32j4-9...
Exploit https://hackerone.com/reports/1450368
Patch https://github.com/nextcloud/android/pull/9816
Third Party Advisory https://github.com/nextcloud/security-advisories/security/advisories/GHSA-32j4-9...
Exploit https://hackerone.com/reports/1450368
14
/ 100
low-risk
Severity 9/34 · Low
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal