A vulnerability was found in Nextcloud App up to 2.x on Android (Android App Software) and classified as problematic. Affected by this issue is an unknown code block of the component Local Cache Handler. The manipulation with an unknown input leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

SQL Injection in the Nextcloud Android app prior to version 3.0.0 allows to destroy a local cache when a harmful query is executed requiring to resetup the account.

The weakness was released 07/30/2019. This vulnerability is handled as CVE-2019-5454 since 01/04/2019. Local access is required to approach this attack. No form of authentication is required for exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1505 by the MITRE ATT&CK project.

Upgrading to version 3.0.0 eliminates this vulnerability.

Entries connected to this vulnerability are available at VDB-139047, VDB-139045, VDB-139043 and VDB-139042.

Productinfo

Type

• Android App Software

Vendor

• Nextcloud

Name

• App

Version

• 2.x

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion