VULNERABILITY INTELLIGENCE

CVE-2021-22905

CVSS score6.5 MEDIUM

EPSS probability1.37%

CISA KEVNot currently listed

Published2021-06-11

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Description

Nextcloud Android App (com.nextcloud.client) before v3.16.0 is vulnerable to information disclosure due to searches for sharees being performed by default on the lookup server instead of only using the local Nextcloud server unless a global search has been explicitly chosen by the user.

Weakness classification

support@hackerone.com: CWE-200
nvd@nist.gov: CWE-200

Primary references

support@hackerone.com — Third Party Advisory
support@hackerone.com — Exploit, Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Third Party Advisory