CVE-2023-49790

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-49790

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-49790.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-49790

Aliases

BIT-nextcloud-2023-49790
GHSA-j8g7-88vv-rggv

Published

2023-12-22T16:19:28.440Z

Modified

2026-07-15T02:09:49.208040112Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

App PIN code can be bypassed in Nextcloud Files iOS

Details

The Nextcloud iOS Files app allows users of iOS to interact with Nextcloud, a self-hosted productivity platform. Prior to version 4.9.2, the application can be used without providing the 4 digit PIN code. Nextcloud iOS Files app should be upgraded to 4.9.2 to receive the patch. No known workarounds are available.

Database specific

{
    "cwe_ids": [
        "CWE-287"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49790.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/nextcloud/ios

Affected ranges

Type

GIT

Repo

https://github.com/nextcloud/ios

Events

Introduced

Fixed

2a9b9d80eeef6d3d564b4e0dc07f744b0d88a718

Database specific

{
    "cpe": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:iphone_os:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.9.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

2.*

2.17

2.17.2

2.17.7

2.17.8

2.18.1

2.19.3

2.20.1

2.21.0

2.22.1

2.22.5

2.22.6

2.23.7

3.*

3.0.10

3.0.11

3.0.12

3.0.14

3.0.15

3.1.0

3.2.0

3.3.0

3.4.0

3.4.1

3.4.2

3.4.3

3.4.4

3.4.5

4.*

4.0.0

4.0.1

4.0.2

4.0.3

4.0.4

4.0.5

4.0.6

4.1.0

4.2.0

4.2.1

4.2.2

4.3.0

4.3.1

4.4.0

4.4.1

4.4.2

4.4.3

4.4.4

4.5.0

4.5.1

4.5.2

4.5.3

4.5.4

4.5.5

4.5.6

4.5.7

4.6.0

4.7.0

4.8.0

4.8.1

4.8.3

4.8.4

4.8.5

4.8.6

4.9.0

4.9.1

v2.*

v2.23.8

v2.24.0

v2.24.1

v2.24.2

v2.24.3

v2.25.2

v2.25.3

v2.25.4

v2.25.5

v2.25.6

v2.25.7

v2.25.9

v3.*

v3.0.0

v3.0.1

v3.0.2

v3.0.3

v3.0.4

v3.0.5

v3.0.6

v3.0.7

v3.0.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-49790.json"