Vulnerability · Published Jan 18, 2024 · Assigned by GitHub_M
CVE-2024-22212Nextcloud global site selector authentication bypass
Critical 9.7
In plain English
A critical-severity missing authentication in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).
Official description
Nextcloud Global Site Selector is a tool which allows you to run multiple small Nextcloud instances and redirect users to the right server. A problem in the password verification method allows an attacker to authenticate as another user. It is recommended that the Nextcloud Global Site Selector is upgraded to version 1.4.1, 2.1.2, 2.3.4 or 2.4.5. There are no known workarounds for this issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nextcloud | security-advisories | >= 1.1.0, < 1.4.1>= 2.0.0, < 2.1.2>= 2.2.0, < 2.3.4>= 2.4.0, < 2.4.5 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H