CVE-2020-36248 : Security Advisory and Response

The ownCloud application before 2.15 for Android is vulnerable to a security issue that allows attackers to bypass the PIN lock feature.

Understanding CVE-2020-36248

This CVE involves a vulnerability in the ownCloud application for Android that enables attackers to manipulate PIN preferences.

What is CVE-2020-36248?

The vulnerability in the ownCloud Android app permits attackers to include a PIN preferences value in a backup archive using adb, allowing them to bypass the PIN lock feature by restoring from this archive.

The Impact of CVE-2020-36248

The impact of this vulnerability is rated as low severity with high confidentiality impact, requiring physical access and user interaction to exploit.

Technical Details of CVE-2020-36248

This section provides more technical insights into the CVE.

Vulnerability Description

The vulnerability in the ownCloud Android app allows for the inclusion of a PIN preferences value in a backup archive, enabling the bypassing of the PIN lock feature.

Affected Systems and Versions

Product: ownCloud application for Android
Version: Before 2.15

Exploitation Mechanism

Attack Complexity: High
Attack Vector: Physical
Privileges Required: Low
User Interaction: Required

Mitigation and Prevention

Protecting systems from CVE-2020-36248 requires immediate actions and long-term security practices.

Immediate Steps to Take

Update the ownCloud Android app to version 2.15 or newer.
Avoid restoring from untrusted backup archives.

Long-Term Security Practices

Regularly update applications to the latest versions.
Implement strong PIN or password policies on devices.

Patching and Updates

Ensure that all software and applications are regularly updated to the latest versions to mitigate the risk of this vulnerability.