« Back to list

CVE-2019-5453

Status: ModifiedMedium (6.1)—

Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protection and switching to the Nextcloud file provider.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Nextcloud — Nextcloud

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2019-5453",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "PHYSICAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 0.9
      }
    ]
  },
  "affected": [
    {
      "source": "support@hackerone.com",
      "affectedData": [
        {
          "vendor": "Nextcloud",
          "product": "com.nextcloud.client",
          "versions": [
            {
              "status": "affected",
              "version": "3.3.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-07-30T21:15:11.850",
  "references": [
    {
      "url": "https://hackerone.com/reports/331489",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://hackerone.com/reports/331489",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "support@hackerone.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-288"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protection and switching to the Nextcloud file provider."
    },
    {
      "lang": "es",
      "value": "Una omisión de la protección de bloqueo en la aplicación de Android Nextcloud anterior a versión 3.3.0 permitía el acceso a los archivos cuando se solicitaba la protección de bloqueo y se cambiaba al proveedor de archivos de Nextcloud."
    }
  ],
  "lastModified": "2026-06-17T02:37:42.953",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D2F62007-1F81-4656-A937-C5FC080840CF",
              "versionEndIncluding": "3.2.4"
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud:3.3.0:rc1:*:*:*:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AFF8DB5D-5F93-4613-A1B1-13E3DDEDCE0D"
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud:3.3.0:rc2:*:*:*:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67D38053-1969-4299-80E8-E1CE032D362C"
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud:3.3.0:rc3:*:*:*:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "762C21F5-6061-4572-8AF1-94D895113D24"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "support@hackerone.com"
}