CVE-2019-15611: Medium severity nextcloud vulnerability
Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextcloud services when search e.g. for federated users or registering for push notifications.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-15611?
CVE-2019-15611 is a vulnerability in the iOS App version 2.23.0 of Nextcloud that causes the app to leak its login and token to other Nextcloud services when performing certain actions.
How does the iOS App 2.23.0 leak login and token?
The iOS App 2.23.0 of Nextcloud leaks login and token to other Nextcloud services when searching for federated users or registering for push notifications.
What is the severity of CVE-2019-15611?
CVE-2019-15611 has a severity level of medium with a CVSS score of 4.9.
How can I fix CVE-2019-15611?
To fix CVE-2019-15611, update the Nextcloud iOS App to version 2.24.0 or higher.
Where can I find more information about CVE-2019-15611?
More information about CVE-2019-15611 can be found in the following references: [HackerOne](https://hackerone.com/reports/672623) and [Nextcloud Security Advisory](https://nextcloud.com/security/advisory/?id=NC-SA-2019-017).