CVE-2022-24886

Katalog CVE

CVSS 3.8 · Low EPSS 0,39%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada nextcloud. Skor CVSS 3.1 3.8 (Low) menurut NVD.

Deskripsi (NVD)

Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. In versions prior to 3.19.0, any application with notification permission can access contacts if Nextcloud has access to Contacts without applying for the Contacts permission itself. Version 3.19.0 contains a fix for this issue. There are currently no known workarounds.

Rincian

Terbit di NVD

27 April 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

3.8 (Low), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nextcloud/android/pull/9726 advisory pihak ketiga
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5cj3-v98r-2wmq advisory pihak ketiga
• https://hackerone.com/reports/1161401 permissions required · advisory pihak ketiga