Path Traversal in Nextcloud
CVE-2022-39210
Nextcloud android is the official Android client for the Nextcloud home server platform. Internal paths to the Nextcloud Android app files are not properly protected. As a result access to internal files of the from within the Nextcloud Android app is possible. This may lead to a leak of sensitive information in some cases. It is recommended that the Nextcloud Android app is upgraded to 3.21.0. There are no known workarounds for this issue.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.2 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.003 (21.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 22nd percentile — 21.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: +0.000
Affected products
- Nextcloud
- Nextcloud Security-Advisories — versions < 3.21.0
Weakness classification (CWE)
References
- github.com/nextcloud/security-advisories/security/advisories/GHSA-vw2w-gpcv-v39f (Third Party Advisory)
- github.com/nextcloud/android/pull/10544 (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2022-39210?
- CVE-2022-39210 is a low-severity vulnerability in Nextcloud, classified under Path Traversal. CVSS score: 3.2/10. Published 2022-09-17.
- How severe is CVE-2022-39210?
- Low severity. CVSS v3 base score is 3.2 out of 10.