PT-2023-21871

CVE-2023-28646

Publicado

2023-03-30

Atualizado

2026-07-12

Descrição por

CVSS 3.1

4.4

Média

MétricasAV:P/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Nextcloud Android versions 3.7.0 through 3.24.0

Description The Nextcloud Android app has a security issue that allows an attacker with access to an unlocked physical device to bypass the Pin/passcode protection using a third-party app. This enables the attacker to view meta information such as sharer, sharees, and activity of files.

Recommendations For versions 3.7.0 through 3.24.0, upgrade the Nextcloud Android app to version 3.24.1 to resolve the issue.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Nickvergessen

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-287: Improper Authentication

CWE-281: Improper Preservation of Permissions