Vulnerability · Published Jan 18, 2024 · Assigned by GitHub_M
CVE-2024-22404Permissions bypass in Nextcloud with the files zip app
Medium 4.1
In plain English
A medium-severity security flaw in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Severity (CVSS 3.1)4.1Medium
Exploit odds (30 days)0.5%top 55.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to upgrade should disable the file zip app.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nextcloud | security-advisories | >= 1.2.0, < 1.2.1>= 1.3.0, < 1.4.1 |
Weakness: CWE-281 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vhj3-mch4-67fq x_refsource_CONFIRM
- https://github.com/nextcloud/files_zip/commit/43204539d517a13e945b90652718e2a213f46820 x_refsource_MISC
- https://hackerone.com/reports/2247457 x_refsource_MISC