Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2022-24886

Good to know:

icon

Date: April 27, 2022

Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. In versions prior to 3.19.0, any application with notification permission can access contacts if Nextcloud has access to Contacts without applying for the Contacts permission itself. Version 3.19.0 contains a fix for this issue. There are currently no known workarounds.

Language: Java

Severity Score

Related Resources (5)

https://hackerone.com/reports/1161401
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5cj3-v98r-2wmq
https://nvd.nist.gov/vuln/detail/CVE-2022-24886
https://github.com/nextcloud/android/pull/9726
https://www.mend.io/vulnerability-database/CVE-2022-24886

Severity Score

Weakness Type (CWE)

Incorrect Authorization

CWE-863

Incorrect Permission Assignment for Critical Resource

CWE-732

Top Fix

icon

Upgrade Version

Upgrade to version stable-3.19.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): LOCAL
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): CHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): LOCAL
Access Complexity (AC): LOW
Authentication (AU): NONE
Confidentiality (C): PARTIAL
Integrity (I): NONE
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us