App PIN code can be bypassed in Files iOS

Moderate

nickvergessen published GHSA-j8g7-88vv-rggv

Dec 18, 2023

Package

Files iOS (Nextcloud)

Affected versions

<= 4.9.1

Patched versions

4.9.2

Description

Impact

The application can be used without providing the 4 digit PIN code

Patches

It is recommended that the Nextcloud iOS Files app is upgraded to 4.9.2

Workarounds

No workaround available

References

For more information

If you have any questions or comments about this advisory:

Create a post in nextcloud/security-advisories
Customers: Open a support ticket at portal.nextcloud.com

Severity

Moderate

4.3

/ 10

CVSS base metrics

Attack vector

Physical

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L