Vulnerability Description
Nextcloud iOS before 3.4.2 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only on the local Nextcloud server unless a global search has been explicitly chosen by the user.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nextcloud | Nextcloud | < 3.4.2 |
Related Weaknesses (CWE)
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m7w4-cThird Party Advisory
- https://hackerone.com/reports/1167919ExploitIssue TrackingThird Party Advisory
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m7w4-cThird Party Advisory
- https://hackerone.com/reports/1167919ExploitIssue TrackingThird Party Advisory
FAQ
What is CVE-2021-22912?
CVE-2021-22912 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Nextcloud iOS before 3.4.2 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only on the local Nextcloud server unless a gl...
How severe is CVE-2021-22912?
CVE-2021-22912 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-22912?
Check the references section above for vendor advisories and patch information. Affected products include: Nextcloud Nextcloud.