CVE-2020-36248

The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a backup archive, and consequently bypass the PIN lock feature by restoring from this archive.

CVSS v3 3.9 LOW
CVSS v2.0 2.1 LOW

3.9^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.3 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://owncloud.com/security-advisories/bypassing-app-lock-pattern-passcode-fingerprint-lock-android-oc-sa-2020-003/	Vendor Advisory
https://owncloud.com/security-advisories/bypassing-app-lock-pattern-passcode-fingerprint-lock-android-oc-sa-2020-003/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:owncloud:owncloud_client:*:*:*:*:*:android:*:*

History

26 Mar 2025, 17:06

Type	Values Removed	Values Added
CPE	cpe:2.3:a:owncloud:owncloud::::::android::*	cpe:2.3:a:owncloud:owncloud_client::::::android::*
First Time		Owncloud owncloud Client

Information

Published : 2021-02-19 08:15

Updated : 2025-03-26 17:06

NVD link : CVE-2020-36248

Mitre link : CVE-2020-36248

CVE.ORG link : CVE-2020-36248

JSON object : View

Products Affected

owncloud

owncloud_client

CWE

CWE-312

Cleartext Storage of Sensitive Information

{"id": "CVE-2020-36248", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.9, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.9}]}, "published": "2021-02-19T08:15:11.760", "references": [{"url": "https://owncloud.com/security-advisories/bypassing-app-lock-pattern-passcode-fingerprint-lock-android-oc-sa-2020-003/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://owncloud.com/security-advisories/bypassing-app-lock-pattern-passcode-fingerprint-lock-android-oc-sa-2020-003/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-312"}]}], "descriptions": [{"lang": "en", "value": "The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a backup archive, and consequently bypass the PIN lock feature by restoring from this archive."}, {"lang": "es", "value": "La aplicaci\u00f3n ownCloud versiones anteriores a 2.15 para Android, permite a atacantes usar adb para incluir un valor de preferencias de PIN en un archivo de respaldo y, en consecuencia, omitir la funcionalidad de bloqueo de PIN mediante la restauraci\u00f3n de este archivo"}], "lastModified": "2025-03-26T17:06:15.547", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:owncloud:owncloud_client:*:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "0361E783-EED5-4388-A812-74DF6C0A5E5E", "versionEndExcluding": "2.15"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}