CVE-2021-32695: 
NixOS vulnerability analysis and mitigation

The Nextcloud Android app, which serves as the Android client for Nextcloud, contained a vulnerability (CVE-2021-32695) in versions prior to 3.16.1. The vulnerability allowed a malicious app on the same device to access the Nextcloud Android application's shared preferences. This access required user interaction, specifically the victim initiating the sharing flow and selecting the malicious app. The vulnerability was discovered and disclosed in June 2021 (Nextcloud Advisory).

The vulnerability was related to the application's shared preferences exposure, which contained sensitive data including push tokens and account names. The issue received a CVSS v3.1 Base Score of 3.3 (LOW) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, indicating local access was required with user interaction (NVD). The vulnerability was classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

The vulnerability exposed limited private data stored in the shared preferences of the Nextcloud Android application. Specifically, attackers could access push tokens and account names, potentially compromising user privacy and security (Nextcloud Advisory).

The vulnerability was patched in Nextcloud Android app version 3.16.1. Users were recommended to upgrade to this version or later to protect against the vulnerability. No alternative workarounds were available (Nextcloud Advisory).