CVE-2021-22912

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Nextcloud iOS before 3.4.2 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only on the local Nextcloud server unless a global search has been explicitly chosen by the user.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	Nextcloud iOS app (it.twsweb.Nextcloud)	Fixed in 3.4.2

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m7w4-cvjr-76mhThird Party Advisory
https://hackerone.com/reports/1167919Exploit, Issue Tracking, Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m7w4-cvjr-76mhThird Party Advisory
https://hackerone.com/reports/1167919Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Jun 11, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-229136.5Nextcloud Deck before 1.2.7, 1.4.1 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server CVE-2021-229147.5Citrix Cloud Connector before 6.31.0.62192 suffers from insecure storage of sensitive information due to sensitive information being stored CVE-2021-229159.8Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limit CVE-2021-229165.9In Brave Desktop between versions 1.17 and 1.26.60, when adblocking is enabled and a proxy browser extension is installed, the CNAME adblock CVE-2021-229176.5Brave Browser Desktop between versions 1.17 and 1.20 is vulnerable to information disclosure by way of DNS requests in Tor windows not flowi CVE-2021-229185.3Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. CVE-2021-229197.5A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway)CVE-2021-22928.1Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Document Management). Suppo CVE-2021-229206.5A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway)CVE-2021-229217.8Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platform CVE-2021-229226.5When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML CVE-2021-229235.3When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file,