Vulnerability Details CVE-2021-41256
nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issue by which a malicious application installed on the same device can send it an arbitrary Intent that gets reflected back, unintentionally giving read and write access to non-exported Content Providers in Nextcloud News for Android. Users should upgrade to version 0.9.9.63 or higher as soon as possible.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 47.1%
CVSS Severity
CVSS v3 Score 5.8
CVSS v2 Score 5.8
References
- https://github.com/nextcloud/news-android/blob/master/security/GHSL-2021-1033_Nextcloud_News_for_Android.md
- https://github.com/nextcloud/news-android/commit/05449cb666059af7de2302df9d5c02997a23df85
- https://github.com/nextcloud/news-android/security/advisories/GHSA-2q9v-q3cc-h9f3
- https://github.com/nextcloud/news-android/blob/master/security/GHSL-2021-1033_Nextcloud_News_for_Android.md
- https://github.com/nextcloud/news-android/commit/05449cb666059af7de2302df9d5c02997a23df85
- https://github.com/nextcloud/news-android/security/advisories/GHSA-2q9v-q3cc-h9f3
Products affected by CVE-2021-41256
-
cpe:2.3:a:nextcloud:news:0.4.10
-
cpe:2.3:a:nextcloud:news:0.5.2
-
cpe:2.3:a:nextcloud:news:0.5.4
-
cpe:2.3:a:nextcloud:news:0.5.5
-
cpe:2.3:a:nextcloud:news:0.5.8
-
cpe:2.3:a:nextcloud:news:0.6.1
-
cpe:2.3:a:nextcloud:news:0.6.9.5
-
cpe:2.3:a:nextcloud:news:0.7.4
-
cpe:2.3:a:nextcloud:news:0.7.5
-
cpe:2.3:a:nextcloud:news:0.7.7
-
cpe:2.3:a:nextcloud:news:0.8.4
-
cpe:2.3:a:nextcloud:news:0.8.4.5
-
cpe:2.3:a:nextcloud:news:0.8.8
-
cpe:2.3:a:nextcloud:news:0.8.9.5
-
cpe:2.3:a:nextcloud:news:0.9.0
-
cpe:2.3:a:nextcloud:news:0.9.1
-
cpe:2.3:a:nextcloud:news:0.9.3
-
cpe:2.3:a:nextcloud:news:0.9.4
-
cpe:2.3:a:nextcloud:news:0.9.5
-
cpe:2.3:a:nextcloud:news:0.9.5.2
-
cpe:2.3:a:nextcloud:news:0.9.6.1
-
cpe:2.3:a:nextcloud:news:0.9.6.3
-
cpe:2.3:a:nextcloud:news:0.9.7
-
cpe:2.3:a:nextcloud:news:0.9.7.2
-
cpe:2.3:a:nextcloud:news:0.9.7.3
-
cpe:2.3:a:nextcloud:news:0.9.7.4
-
cpe:2.3:a:nextcloud:news:0.9.7.5
-
cpe:2.3:a:nextcloud:news:0.9.7.6
-
cpe:2.3:a:nextcloud:news:0.9.8
-
cpe:2.3:a:nextcloud:news:0.9.8.1
-
cpe:2.3:a:nextcloud:news:0.9.8.2
-
cpe:2.3:a:nextcloud:news:0.9.8.3
-
cpe:2.3:a:nextcloud:news:0.9.8.3.1
-
cpe:2.3:a:nextcloud:news:0.9.8.4
-
cpe:2.3:a:nextcloud:news:0.9.8.5
-
cpe:2.3:a:nextcloud:news:0.9.8.7
-
cpe:2.3:a:nextcloud:news:0.9.9.0
-
cpe:2.3:a:nextcloud:news:0.9.9.1
-
cpe:2.3:a:nextcloud:news:0.9.9.10
-
cpe:2.3:a:nextcloud:news:0.9.9.11
-
cpe:2.3:a:nextcloud:news:0.9.9.11-1
-
cpe:2.3:a:nextcloud:news:0.9.9.12
-
cpe:2.3:a:nextcloud:news:0.9.9.13
-
cpe:2.3:a:nextcloud:news:0.9.9.15
-
cpe:2.3:a:nextcloud:news:0.9.9.16
-
cpe:2.3:a:nextcloud:news:0.9.9.16.1
-
cpe:2.3:a:nextcloud:news:0.9.9.17.1
-
cpe:2.3:a:nextcloud:news:0.9.9.18
-
cpe:2.3:a:nextcloud:news:0.9.9.19
-
cpe:2.3:a:nextcloud:news:0.9.9.19.1
-
cpe:2.3:a:nextcloud:news:0.9.9.19.2
-
cpe:2.3:a:nextcloud:news:0.9.9.2
-
cpe:2.3:a:nextcloud:news:0.9.9.20
-
cpe:2.3:a:nextcloud:news:0.9.9.21
-
cpe:2.3:a:nextcloud:news:0.9.9.22
-
cpe:2.3:a:nextcloud:news:0.9.9.23
-
cpe:2.3:a:nextcloud:news:0.9.9.24
-
cpe:2.3:a:nextcloud:news:0.9.9.25
-
cpe:2.3:a:nextcloud:news:0.9.9.26
-
cpe:2.3:a:nextcloud:news:0.9.9.3
-
cpe:2.3:a:nextcloud:news:0.9.9.31
-
cpe:2.3:a:nextcloud:news:0.9.9.32
-
cpe:2.3:a:nextcloud:news:0.9.9.33
-
cpe:2.3:a:nextcloud:news:0.9.9.34
-
cpe:2.3:a:nextcloud:news:0.9.9.35
-
cpe:2.3:a:nextcloud:news:0.9.9.36
-
cpe:2.3:a:nextcloud:news:0.9.9.38
-
cpe:2.3:a:nextcloud:news:0.9.9.4
-
cpe:2.3:a:nextcloud:news:0.9.9.40
-
cpe:2.3:a:nextcloud:news:0.9.9.50
-
cpe:2.3:a:nextcloud:news:0.9.9.6
-
cpe:2.3:a:nextcloud:news:0.9.9.60
-
cpe:2.3:a:nextcloud:news:0.9.9.61
-
cpe:2.3:a:nextcloud:news:0.9.9.62
-
cpe:2.3:a:nextcloud:news:0.9.9.7
-
cpe:2.3:a:nextcloud:news:0.9.9.8
-
cpe:2.3:a:nextcloud:news:0.9.9.9
-
cpe:2.3:a:nextcloud:news:0.9.9.9.1