CVE-2021-32695: Malicious Android app could access Shared Preferences of the Nextcloud Android client
Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.16.1, a malicious app on the same device could have gotten access to the shared preferences of the Nextcloud Android application. This required user-interaction as a victim had to initiate the sharing flow and choose the malicious app. The shared preferences contain some limited private data such as push tokens and the account name. The vulnerability is patched in version 3.16.1.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-32695?
CVE-2021-32695 is a vulnerability in the Nextcloud Android app that allows a malicious app on the same device to access the shared preferences of the Nextcloud app.
What is the severity of CVE-2021-32695?
The severity of CVE-2021-32695 is medium with a CVSS score of 3.3.
How can I fix CVE-2021-32695?
To fix CVE-2021-32695, update to version 3.16.1 or later of the Nextcloud Android app.
Are there any references for CVE-2021-32695?
Yes, you can find references for CVE-2021-32695 at the following URLs: [Reference 1](https://github.com/nextcloud/android/pull/8433), [Reference 2](https://github.com/nextcloud/security-advisories/security/advisories/GHSA-25m9-cf6c-qf2c), [Reference 3](https://hackerone.com/reports/1142918).
What is the Common Weakness Enumeration (CWE) ID for CVE-2021-32695?
The CWE ID for CVE-2021-32695 is CWE-200.