CVE-2019-15611

Опубликовано: 04 фев. 2020

Источник: nvd

CVSS3: 4.9

CVSS2: 4

EPSS Низкий

Описание

Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextcloud services when search e.g. for federated users or registering for push notifications.

Ссылки

https://hackerone.com/reports/672623
Permissions Required
Third Party Advisory
https://nextcloud.com/security/advisory/?id=NC-SA-2019-017
Vendor Advisory
https://hackerone.com/reports/672623
Permissions Required
Third Party Advisory
https://nextcloud.com/security/advisory/?id=NC-SA-2019-017
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:iphone_os:*:*

Версия до 2.24.0 (исключая)

EPSS

Процентиль: 71%

0.00662

Низкий

4.9 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-657

NVD-CWE-Other

Связанные уязвимости

GHSA-pq96-5h3g-gqch

github

больше 3 лет назад