Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 21.0.8, 22.2.4, and 23.0.1, it is possible to trick administrators into enabling "recommended" apps for the Nextcloud server that they do not need, thus expanding their attack surface unnecessarily. This issue is fixed in versions 21.0.8 , 22.2.4, and 23.0.1.
References
| Link | Resource |
|---|---|
| https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5vw6-6prg-gvw6 | Third Party Advisory |
| https://github.com/nextcloud/server/pull/30615 | Third Party Advisory |
| https://hackerone.com/reports/1403614 | Exploit Third Party Advisory |
| https://security.gentoo.org/glsa/202208-17 | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
25 Oct 2022, 20:51
| Type | Values Removed | Values Added |
|---|---|---|
| References | (GENTOO) https://security.gentoo.org/glsa/202208-17 - Third Party Advisory |
11 Aug 2022, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
06 May 2022, 18:11
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:* | |
| CWE | CWE-345 | |
| References | (MISC) https://hackerone.com/reports/1403614 - Exploit, Third Party Advisory | |
| References | (CONFIRM) https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5vw6-6prg-gvw6 - Third Party Advisory | |
| References | (MISC) https://github.com/nextcloud/server/pull/30615 - Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 4.3 |
| First Time |
Nextcloud nextcloud Server
Nextcloud |
27 Apr 2022, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-04-27 15:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-24889
Mitre link : CVE-2022-24889
CVE.ORG link : CVE-2022-24889
JSON object : View
Products Affected
nextcloud
- nextcloud_server
CWE
CWE-345
Insufficient Verification of Data Authenticity