VULNERABILITY INTELLIGENCE

CVE-2019-15611

CVSS score4.9 MEDIUM

EPSS probability1.08%

CISA KEVNot currently listed

Published2020-02-04

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Description

Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextcloud services when search e.g. for federated users or registering for push notifications.

Weakness classification

support@hackerone.com: CWE-657
nvd@nist.gov: NVD-CWE-Other

Primary references

support@hackerone.com — Permissions Required, Third Party Advisory
support@hackerone.com — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Permissions Required, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory