Security readout for executives and security teams
Plain-English summary
Affected Nextcloud Android App versions could send sharee search terms to Nextcloud's lookup server by default, rather than only searching the organization's local server. This may expose who users are trying to find or share with. The fixed version is 3.16.0.
Executive priority
Treat this as a privacy and confidentiality cleanup item. Prioritize update enforcement for users handling sensitive collaboration data, but the bundle does not support emergency active-exploitation claims.
Technical view
CVE-2021-22905 is a CWE-200 information disclosure issue in com.nextcloud.client before 3.16.0. The app performed sharee searches against the lookup server by default unless the user explicitly selected global search. The bundle provides no CVSS score.
Likely exposure
Organizations with users running Nextcloud Android App versions earlier than 3.16.0 are potentially exposed, especially where sharee searches involve sensitive names, emails, or collaboration patterns.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation evidence. Risk is primarily unintended disclosure during normal app use, not confirmed malicious exploitation.
Researcher notes
Evidence is limited to public advisory metadata and the reported behavior. Validate exposure through client version inventory and user workflow review. Do not assume server-side compromise from this CVE alone.
Mitigation direction
- Update Nextcloud Android App to version 3.16.0 or later.
- Check the Nextcloud security advisory for vendor guidance.
- Use mobile device management to enforce the updated app version.
- Avoid sensitive sharee searches from outdated clients until remediated.
Validation and detection
- Inventory Android devices running com.nextcloud.client.
- Confirm no installed app versions are earlier than 3.16.0.
- Review MDM or app-store deployment records for update completion.
- Identify teams using sensitive sharing workflows in the Android app.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-22905 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-22v9-q3r6-x7cjCVE reference · x_refsource_MISC
- https://hackerone.com/reports/1167916CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.