CVE-2023-28647

App pin of the iOS app can be bypassed in Nextcloud iOS

CVSS 4.4 MEDIUMEPSS 0.3%CWE-281 CWE-287

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 4.4EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

30 mar 2023Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access to an unlocked device, they may enable the integration into the iOS Files app and bypass the Nextcloud pin/password protection and gain access to a users files. It is recommended that the Nextcloud iOS app is upgraded to 4.7.0. There are no known workarounds for this vulnerability.

CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

Produtos afetados

nextcloud · security-advisories

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/nextcloud/ios/pull/2344 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wjgg-2v4p-2gq6