CVE-2021-32694

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.15.1, a malicious application on the same device is possible to crash the Nextcloud Android Client due to an uncaught exception. The vulnerability is patched in version 3.15.1.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-248

Affected software

Vendor	Product	Versions
nextcloud	security-advisories	< 3.15.1

References

https://github.com/nextcloud/android/pull/7919Patch, Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h2gm-m374-99vcThird Party Advisory
https://hackerone.com/reports/859136Exploit, Issue Tracking, Third Party Advisory
https://github.com/nextcloud/android/pull/7919Patch, Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h2gm-m374-99vcThird Party Advisory
https://hackerone.com/reports/859136Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Jun 17, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-326953.3Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.16.1, a malicious app on the same device could have gotten CVE-2021-326965.3The npm package "striptags" is an implementation of PHP's strip_tags in Typescript. In striptags before version 3.2.0, a type-confusion vuln CVE-2021-326975.3neos/forms is an open source framework to build web forms. By crafting a special `GET` request containing a valid form state, a form can be CVE-2021-326984.9eLabFTW is an open source electronic lab notebook for research labs. This vulnerability allows an attacker to make GET requests on behalf of CVE-2021-326996.5Wings is the control plane software for the open source Pterodactyl game management system. All versions of Pterodactyl Wings prior to `1.4.CVE-2021-327007.4Ballerina is an open source programming language and platform for cloud application programmers. Ballerina versions 1.2.x and SL releases up CVE-2021-327017.5ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rul CVE-2021-327026.1The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including `1.4.1` are v CVE-2021-327035.3Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of rat CVE-2021-327048.8DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerabilit CVE-2021-327057.5Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of rat CVE-2021-327068.8Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web int