Low
Security advisory
Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables when using custom queries.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-15622
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 05:39 UTC · Revision 1
Source evidence
Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables when using custom queries.
osv:CVE-2019-15622
Complete source record
{
"id": "2943d2a54fa673fce89f891ecd1d25be92dbd29052f713482d1869bc38201c64",
"url": "https://osv.dev/vulnerability/CVE-2019-15622",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-15622",
"summary": "Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables when using custom queries.",
"evidence": "osv:CVE-2019-15622",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2019-15622",
"aliases": [
"CVE-2019-15622"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/nextcloud/android",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "904e6c50e70e4560661216a42808a47e8816789f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:android:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "3.6.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"rc-3.6.1-02",
"rc-3.6.1-01",
"stable-3.6.0",
"rc-3.6.0-03",
"rc-3.6.0-02",
"rc-3.6.0-01",
"dev-20190327",
"dev-20190323",
"dev-20190321",
"dev-20190320",
"dev-20190319",
"dev-20190316",
"dev-20190314",
"dev-20190313",
"dev-20190312",
"dev-20190310",
"dev-20190309",
"dev-20190308",
"dev-20190307",
"dev-20190306",
"dev-20190305",
"dev-20190301",
"dev-20190228",
"dev-20190227",
"dev-20190226",
"dev-20190221",
"dev-20190220",
"dev-20190219",
"dev-20190216",
"dev-20190215",
"dev-20190214",
"dev-20190213",
"dev-20190212",
"dev-20190209",
"dev-20190208",
"dev-20190207",
"dev-20190206",
"dev-20190205",
"dev-20190202",
"dev-20190201",
"dev-20190131",
"dev-20190130",
"dev-20190129",
"dev-20190126",
"dev-20190123",
"dev-20190122",
"dev-20190119",
"dev-20190118",
"dev-20190117",
"dev-20190116",
"dev-20190115",
"dev-20190113",
"dev-20190112",
"dev-20190108",
"dev-20190105",
"dev-20181222",
"dev-20181218",
"dev-20181216",
"dev-20181215",
"dev-20181214",
"dev-20181212",
"dev-20181211",
"dev-20181208",
"dev-20181207",
"dev-20181206",
"dev-20181204",
"dev-20181203",
"dev-20181107",
"dev-20181106",
"dev-20181103",
"dev-20181102",
"dev-20181101",
"dev-20181031",
"dev-20181030",
"dev-20181028",
"dev-20181027",
"dev-20181026",
"dev-20181025",
"dev-20181024",
"dev-20181023",
"dev-20181020",
"dev-20181018",
"dev-20181016",
"dev-20181013",
"dev-20181009",
"dev-20181006",
"dev-20180927",
"dev-20180926",
"dev-20180925",
"dev-20180924",
"dev-20180921",
"dev-20180920",
"dev-20180919",
"dev-20180918",
"dev-20180915",
"dev-20180914",
"dev-20180907",
"dev-20180913",
"dev-20180912",
"dev-20180911",
"dev-20180908",
"dev-20180905",
"dev-20180903",
"dev-20180829",
"dev-20180825",
"dev-20180824",
"dev-20180823",
"dev-20180821",
"dev-20180811",
"dev-20180809",
"rc-3.1.0-02",
"rc-3.1.0-01",
"rc-3.0.0-03",
"rc-3.0.0-02",
"rc-3.0.0-01",
"dev-20171213",
"dev-20171212",
"dev-20171211",
"dev-20171209",
"stable-2.0.0",
"rc-2.0.0-09",
"rc-2.0.0-08",
"rc-2.0.0-07",
"rc-2.0.0-06",
"rc-2.0.0-05",
"rc-2.0.0-04",
"rc-2.0.0-03",
"rc-2.0.0-01",
"stable-1.4.3",
"stable-1.4.2",
"rc-1.4.2-04",
"rc-1.4.2-02",
"rc-1.4.2-01",
"stable-1.4.1",
"rc-1.4.1-04",
"rc-1.4.1-03",
"rc-1.4.1-02",
"rc-1.4.1-01",
"stable-1.4.0",
"rc-1.4.0-04",
"rc-1.4.0-03",
"rc-1.4.0-02",
"rc-1.4.0-01",
"stable-1.3.1",
"stable-1.3.0",
"rc-1.3.0-02",
"rc-1.3.0-01",
"stable-1.2.0",
"rc-1.2.0-02",
"rc-1.2.0-01",
"stable-1.1.0",
"rc-1.1.0-02",
"rc-1.1.0-01",
"stable-1.0.1",
"stable-1.0.0",
"1.0.0",
"0.99",
"oc-android-1.8",
"oc-android-1.7.1_signed",
"oc-android-1.7.0_signed",
"oc-android-1.7.0",
"oc-android-1.5.3",
"1.4.6-easy-setup",
"oc-android-1.4.6",
"oc-android-1.4.5",
"oc-android-1.4.4",
"oc-android-1.4.3",
"oc-android-1-4-0",
"oc-android-1-3-20",
"oc-android-1-3-19",
"oc-android-1-3-18",
"oc-android-1-3-17",
"oc-android-1-3-14",
"oc-android-1-3-13"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15622.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/nextcloud/desktop",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "5dfc0caab65080b4c3c8c3ac42bac766c11ea28c"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:android:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "3.6.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v3.6.0",
"v3.6.0-rc2",
"v3.6.0-rc1",
"v3.5.0",
"v3.5.0-rc4",
"v3.5.0-rc3",
"v3.5.0-rc2",
"v3.5.0-rc1",
"v3.4.0-do-not-use",
"v3.4.0-rc2",
"v3.4.0-rc1",
"v3.3.0",
"v3.3.0-rc2",
"v3.3.0-rc1",
"v3.2.0-rc3",
"v3.2.0-rc2",
"v3.2.0-rc1",
"v3.1.0",
"v3.1.0-rc2",
"v3.1.0-rc1",
"v2.7.0-rc1",
"v2.7.0-beta3",
"v2.7.0-beta2",
"v2.7.0-beta1",
"v2.5.3-rc2",
"v2.5.3-rc1",
"v2.5.2",
"v2.5.2-rc1",
"v2.5.1",
"v2.5.0",
"v2.5.0-rc2",
"v2.5.0-rc1",
"v2.5.0-beta2",
"v2.5.0-beta1",
"v1.8.0-beta1a",
"v1.8.0-beta1",
"v1.6.0",
"v1.6.0-rc3",
"v1.6.0-rc2",
"v1.6.0-rc1",
"v1.6.0-beta2",
"v1.6.0-beta1",
"v1.5.1-rc1",
"v1.5.0",
"v1.5.0-beta3",
"v1.5.0-beta1-2nd",
"v1.5.0-beta2",
"v1.5.0-beta1",
"v1.4.0",
"v1.4.0-rc1",
"v1.4.0-beta2",
"v1.4.0-beta1",
"v1.3.0-beta3",
"v1.3.0-beta2",
"v1.3.0-beta1",
"v1.2.5",
"v1.2.4",
"v1.2.3",
"v1.2.2",
"v1.2.1",
"v1.2.0",
"v1.1.2",
"v1.1.0",
"v1.1.0-beta1",
"v0.0.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15622.json"
}
}
],
"modified": "2026-10-24T10:30:31.907918602Z",
"provider": "osv",
"references": [
"https://nextcloud.com/security/advisory/?id=NC-SA-2019-011",
"https://hackerone.com/reports/518669"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:android:*:*"
],
"vendor_product": "nextcloud:nextcloud",
"extracted_events": [
{
"range": [
{
"fixed": "3.6.1"
}
],
"source": "CPE_RANGE"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-15622",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 432902,
"published_at": "2020-02-04T20:15:12.59+00:00"
}