PT-2021-23218

CVE-2021-41256

Published

2021-11-30

Updated

2021-12-02

Description by

CVSS 3.1

7.1

High

MetricsAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud News for Android versions prior to 0.9.9.63

Description The Nextcloud News for Android app has a security issue where a malicious application installed on the same device can send it an arbitrary Intent that gets reflected back, unintentionally giving read and write access to non-exported Content Providers in Nextcloud News for Android.

Recommendations For versions prior to 0.9.9.63, upgrade to version 0.9.9.63 or higher as soon as possible. As a temporary workaround, consider restricting access to the non-exported Content Providers to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Researchers

Atorralba

Kevinbackhouse

Vendors

Affected products

Weakness enumeration

CWE-829: Inclusion of Functionality from Untrusted Control Sphere

Related identifiers

CVE-2021-41256