« Volver al listado

CVE-2019-5453

Estado: ModificadaMedia (6.1)—

Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protection and switching to the Nextcloud file provider.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Nextcloud — Nextcloud

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-5453",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "PHYSICAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 0.9
      }
    ]
  },
  "affected": [
    {
      "source": "support@hackerone.com",
      "affectedData": [
        {
          "vendor": "Nextcloud",
          "product": "com.nextcloud.client",
          "versions": [
            {
              "status": "affected",
              "version": "3.3.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-07-30T21:15:11.850",
  "references": [
    {
      "url": "https://hackerone.com/reports/331489",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://hackerone.com/reports/331489",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "support@hackerone.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-288"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protection and switching to the Nextcloud file provider."
    },
    {
      "lang": "es",
      "value": "Una omisión de la protección de bloqueo en la aplicación de Android Nextcloud anterior a versión 3.3.0 permitía el acceso a los archivos cuando se solicitaba la protección de bloqueo y se cambiaba al proveedor de archivos de Nextcloud."
    }
  ],
  "lastModified": "2026-06-17T02:37:42.953",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D2F62007-1F81-4656-A937-C5FC080840CF",
              "versionEndIncluding": "3.2.4"
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud:3.3.0:rc1:*:*:*:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AFF8DB5D-5F93-4613-A1B1-13E3DDEDCE0D"
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud:3.3.0:rc2:*:*:*:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67D38053-1969-4299-80E8-E1CE032D362C"
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud:3.3.0:rc3:*:*:*:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "762C21F5-6061-4572-8AF1-94D895113D24"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "support@hackerone.com"
}