Vulnerability · Published Apr 27, 2022 · Assigned by GitHub_M

CVE-2022-24889Insufficient Verification of Data Authenticity in Nextcloud Server

Low 2.4

In plain English

A low-severity insufficient verification of data authenticity in security-advisories from nextcloud. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)2.4Low

Exploit odds (30 days)0.7%top 48.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 21.0.8, 22.2.4, and 23.0.1, it is possible to trick administrators into enabling "recommended" apps for the Nextcloud server that they do not need, thus expanding their attack surface unnecessarily. This issue is fixed in versions 21.0.8 , 22.2.4, and 23.0.1.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	< 21.0.8< 22.2.4< 23.0.1

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5vw6-6prg-gvw6 x_refsource_CONFIRM
https://github.com/nextcloud/server/pull/30615 x_refsource_MISC
https://hackerone.com/reports/1403614 x_refsource_MISC
GLSA-202208-17 vendor-advisory, x_refsource_GENTOO