CVE-2021-41256
Medium
Description
nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issue by which a malicious application installed on the same device can send it an arbitrary Intent that gets reflected back, unintentionally giving read and write access to non-exported Content Providers in Nextcloud News for Android. Users should upgrade to version 0.9.9.63 or higher as soon as possible.
SeverityMedium
CVSS5.8
Exploit probability—
Product
Nextcloud News
PublishedNov 30, 2021
First seenNov 30, 2021
Weakness typeCWE-829CWE-829
How to fix
Update
- nextcloud news0.9.9.63 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nextcloud news | v < 0.9.9.63 | 0.9.9.63 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.