6.1

CVE-2019-5453

Exploit

Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protection and switching to the Nextcloud file provider.

Data is provided by the National Vulnerability Database (NVD)
Nextcloud ≫ Nextcloud SwPlatformandroid Version <= 3.2.4
Nextcloud ≫ Nextcloud Version3.3.0 Updaterc1 SwPlatformandroid
Nextcloud ≫ Nextcloud Version3.3.0 Updaterc2 SwPlatformandroid
Nextcloud ≫ Nextcloud Version3.3.0 Updaterc3 SwPlatformandroid
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.05% 0.159
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.1 0.9 5.2
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvd@nist.gov 3.6 3.9 4.9
AV:L/AC:L/Au:N/C:P/I:P/A:N
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

CWE-288 Authentication Bypass Using an Alternate Path or Channel

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

https://hackerone.com/reports/331489
Third Party Advisory
Exploit