Vulnerability · Published May 20, 2022 · Assigned by GitHub_M
CVE-2022-24906Error in deleting deck cards attachment reveals the full application path in Nextcloud Deck
Low 3.5
In plain English
A low-severity information exposure in security-advisories from nextcloud. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)1.1%top 34.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud, similar to Trello. The full path of the application is exposed to unauthorized users. It is recommended that the Nextcloud Deck app is upgraded to 1.2.11, 1.4.6, or 1.5.4. There is no workaround available.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nextcloud | security-advisories | < 1.2.11>= 1.4.0, < 1.4.6>= 1.5.0, < 1.5.4 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hx9w-xfrg-2qvp x_refsource_CONFIRM
- https://github.com/nextcloud/deck/pull/3384 x_refsource_MISC
- https://hackerone.com/reports/1354334 x_refsource_MISC