Lucene search

K
cve[email protected]CVE-2019-15622
HistoryFeb 04, 2020 - 8:15 p.m.

CVE-2019-15622

2020-02-0420:15:12
CWE-89
web.nvd.nist.gov
37
nvd
cve-2019-15622
nextcloud
android
app
security
vulnerability
sanitization
content leak
custom queries

2.4 Low

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

3.5 Low

AI Score

Confidence

High

2.1 Low

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

34.1%

Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables when using custom queries.

Affected configurations

NVD
Node
nextcloudnextcloudRange<3.6.1android
CPENameOperatorVersion
nextcloud:nextcloudnextcloudlt3.6.1

CNA Affected

[
  {
    "product": "Nextcloud Android",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "3.6.0"
      }
    ]
  }
]

2.4 Low

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

3.5 Low

AI Score

Confidence

High

2.1 Low

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

34.1%