Low
Security advisory
Bypass lock protection in the Nextcloud Android app prior to version 3.6.2 causes leaking of thumbnails when requesting the Android content provider although the lock protection was not solved.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-5452
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 08:13 UTC · Revision 1
Source evidence
Bypass lock protection in the Nextcloud Android app prior to version 3.6.2 causes leaking of thumbnails when requesting the Android content provider although the lock protection was not solved.
osv:CVE-2019-5452
Complete source record
{
"id": "63c6d79ce491af2c3efad7453e072b36536aa679bbf422d6288496ba6ad4ece1",
"url": "https://osv.dev/vulnerability/CVE-2019-5452",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-5452",
"summary": "Bypass lock protection in the Nextcloud Android app prior to version 3.6.2 causes leaking of thumbnails when requesting the Android content provider although the lock protection was not solved.",
"evidence": "osv:CVE-2019-5452",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2019-5452",
"aliases": [
"CVE-2019-5452"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/nextcloud/android",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "305db4b82de8a5cb247cdd6bfa189e2a59b54ac5"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:android:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "3.6.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"rc-3.6.2-01",
"stable-3.6.1",
"rc-3.6.1-02",
"rc-3.6.1-01",
"stable-3.6.0",
"rc-3.6.0-03",
"rc-3.6.0-02",
"rc-3.6.0-01",
"dev-20190327",
"dev-20190323",
"dev-20190321",
"dev-20190320",
"dev-20190319",
"dev-20190316",
"dev-20190314",
"dev-20190313",
"dev-20190312",
"dev-20190310",
"dev-20190309",
"dev-20190308",
"dev-20190307",
"dev-20190306",
"dev-20190305",
"dev-20190301",
"dev-20190228",
"dev-20190227",
"dev-20190226",
"dev-20190221",
"dev-20190220",
"dev-20190219",
"dev-20190216",
"dev-20190215",
"dev-20190214",
"dev-20190213",
"dev-20190212",
"dev-20190209",
"dev-20190208",
"dev-20190207",
"dev-20190206",
"dev-20190205",
"dev-20190202",
"dev-20190201",
"dev-20190131",
"dev-20190130",
"dev-20190129",
"dev-20190126",
"dev-20190123",
"dev-20190122",
"dev-20190119",
"dev-20190118",
"dev-20190117",
"dev-20190116",
"dev-20190115",
"dev-20190113",
"dev-20190112",
"dev-20190108",
"dev-20190105",
"dev-20181222",
"dev-20181218",
"dev-20181216",
"dev-20181215",
"dev-20181214",
"dev-20181212",
"dev-20181211",
"dev-20181208",
"dev-20181207",
"dev-20181206",
"dev-20181204",
"dev-20181203",
"dev-20181107",
"dev-20181106",
"dev-20181103",
"dev-20181102",
"dev-20181101",
"dev-20181031",
"dev-20181030",
"dev-20181028",
"dev-20181027",
"dev-20181026",
"dev-20181025",
"dev-20181024",
"dev-20181023",
"dev-20181020",
"dev-20181018",
"dev-20181016",
"dev-20181013",
"dev-20181009",
"dev-20181006",
"dev-20180927",
"dev-20180926",
"dev-20180925",
"dev-20180924",
"dev-20180921",
"dev-20180920",
"dev-20180919",
"dev-20180918",
"dev-20180915",
"dev-20180914",
"dev-20180907",
"dev-20180913",
"dev-20180912",
"dev-20180911",
"dev-20180908",
"dev-20180905",
"dev-20180903",
"dev-20180829",
"dev-20180825",
"dev-20180824",
"dev-20180823",
"dev-20180821",
"dev-20180811",
"dev-20180809",
"rc-3.1.0-02",
"rc-3.1.0-01",
"rc-3.0.0-03",
"rc-3.0.0-02",
"rc-3.0.0-01",
"dev-20171213",
"dev-20171212",
"dev-20171211",
"dev-20171209",
"stable-2.0.0",
"rc-2.0.0-09",
"rc-2.0.0-08",
"rc-2.0.0-07",
"rc-2.0.0-06",
"rc-2.0.0-05",
"rc-2.0.0-04",
"rc-2.0.0-03",
"rc-2.0.0-01",
"stable-1.4.3",
"stable-1.4.2",
"rc-1.4.2-04",
"rc-1.4.2-02",
"rc-1.4.2-01",
"stable-1.4.1",
"rc-1.4.1-04",
"rc-1.4.1-03",
"rc-1.4.1-02",
"rc-1.4.1-01",
"stable-1.4.0",
"rc-1.4.0-04",
"rc-1.4.0-03",
"rc-1.4.0-02",
"rc-1.4.0-01",
"stable-1.3.1",
"stable-1.3.0",
"rc-1.3.0-02",
"rc-1.3.0-01",
"stable-1.2.0",
"rc-1.2.0-02",
"rc-1.2.0-01",
"stable-1.1.0",
"rc-1.1.0-02",
"rc-1.1.0-01",
"stable-1.0.1",
"stable-1.0.0",
"1.0.0",
"0.99",
"oc-android-1.8",
"oc-android-1.7.1_signed",
"oc-android-1.7.0_signed",
"oc-android-1.7.0",
"oc-android-1.5.3",
"1.4.6-easy-setup",
"oc-android-1.4.6",
"oc-android-1.4.5",
"oc-android-1.4.4",
"oc-android-1.4.3",
"oc-android-1-4-0",
"oc-android-1-3-20",
"oc-android-1-3-19",
"oc-android-1-3-18",
"oc-android-1-3-17",
"oc-android-1-3-14",
"oc-android-1-3-13"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-5452.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/nextcloud/desktop",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "2a703f26b7f77451ad157fcaa215d7e99a4b4015"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:android:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "3.6.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v3.6.1",
"v3.6.0",
"v3.6.0-rc2",
"v3.6.0-rc1",
"v3.5.0",
"v3.5.0-rc4",
"v3.5.0-rc3",
"v3.5.0-rc2",
"v3.5.0-rc1",
"v3.4.0-do-not-use",
"v3.4.0-rc2",
"v3.4.0-rc1",
"v3.3.0",
"v3.3.0-rc2",
"v3.3.0-rc1",
"v3.2.0-rc3",
"v3.2.0-rc2",
"v3.2.0-rc1",
"v3.1.0",
"v3.1.0-rc2",
"v3.1.0-rc1",
"v2.7.0-rc1",
"v2.7.0-beta3",
"v2.7.0-beta2",
"v2.7.0-beta1",
"v2.5.3-rc2",
"v2.5.3-rc1",
"v2.5.2",
"v2.5.2-rc1",
"v2.5.1",
"v2.5.0",
"v2.5.0-rc2",
"v2.5.0-rc1",
"v2.5.0-beta2",
"v2.5.0-beta1",
"v1.8.0-beta1a",
"v1.8.0-beta1",
"v1.6.0",
"v1.6.0-rc3",
"v1.6.0-rc2",
"v1.6.0-rc1",
"v1.6.0-beta2",
"v1.6.0-beta1",
"v1.5.1-rc1",
"v1.5.0",
"v1.5.0-beta3",
"v1.5.0-beta1-2nd",
"v1.5.0-beta2",
"v1.5.0-beta1",
"v1.4.0",
"v1.4.0-rc1",
"v1.4.0-beta2",
"v1.4.0-beta1",
"v1.3.0-beta3",
"v1.3.0-beta2",
"v1.3.0-beta1",
"v1.2.5",
"v1.2.4",
"v1.2.3",
"v1.2.2",
"v1.2.1",
"v1.2.0",
"v1.1.2",
"v1.1.0",
"v1.1.0-beta1",
"v0.0.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-5452.json"
}
}
],
"modified": "2026-10-24T10:31:04.440089417Z",
"provider": "osv",
"references": [
"https://hackerone.com/reports/534541"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:android:*:*"
],
"vendor_product": "nextcloud:nextcloud",
"extracted_events": [
{
"range": [
{
"fixed": "3.6.2"
}
],
"source": "CPE_RANGE"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-5452",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 440526,
"published_at": "2019-07-30T21:15:11.773+00:00"
}