CVSS: 7.3EPSS: 0%CPEs: 3EXPL: 0CVE-2024-37313 – Nextcloud server allows the by-pass the second factor
https://notcve.org/view.php?id=CVE-2024-37313
Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providing the user credentials. It is recommended that the Nextcloud Server is upgraded to 26.0.13, 27.1.8 or 28.0.4 and Nextcloud Enterprise Server is upgraded to 21.0.9.17, 22.2.10.22, 23.0.12.17, 24.0.12.13, 25.0.13.8, 26.0.13, 27.1.8 or 28.0.4. El servidor Nextcloud es un sistema de nube personal autohospedado. En algunas circunstancias, fue posible omitir el segundo factor de 2FA después de proporcionar correctamente las credenciales del usuario. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9v72-9xv5-3p7c https://github.com/nextcloud/server/pull/44276 https://hackerone.com/reports/2419776 • CWE-287: Improper Authentication •
CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37312 – Nextcloud user_oidc app's ID4me feature is available even when disabled
https://notcve.org/view.php?id=CVE-2024-37312
user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventually getting access to data that is available to all registered users. It is recommended that the OpenID Connect user backend is upgraded to 3.0.0 (Nextcloud 20-23), 4.0.0 (Nexcloud 24) or 5.0.0 (Nextcloud 25-28). La aplicación user_oidc es un backend de usuario de OpenID Connect para Nextcloud. La falta de control de acceso en el terminal ID4me permite a un atacante registrar una cuenta y eventualmente obtener acceso a los datos que están disponibles para todos los usuarios registrados. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vw7g-959g-vj6q https://github.com/nextcloud/user_oidc/commit/9f68a716ecd264160a7c098b8840313f1ac855f2 https://hackerone.com/reports/2376929 • CWE-284: Improper Access Control •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-30247 – Command Injection as root in NextCloudPi web panel
https://notcve.org/view.php?id=CVE-2024-30247
NextcloudPi is a ready to use image for Virtual Machines, Raspberry Pi, Odroid HC1, Rock64 and other boards. A command injection vulnerability in NextCloudPi allows command execution as the root user via the NextCloudPi web-panel. Due to a security misconfiguration this can be used by anyone with access to NextCloudPi web-panel, no authentication is required. It is recommended that the NextCloudPi is upgraded to 1.53.1. NextcloudPi es una imagen lista para usar para Máquinas Virtuales, Raspberry Pi, Odroid HC1, Rock64 y otras placas. • https://github.com/nextcloud/nextcloudpi/security/advisories/GHSA-m597-72v7-j982 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2024-22402 – Improper handling of request URLs in Nextcloud Guests app allows guest users to bypass app allowlist
https://notcve.org/view.php?id=CVE-2024-22402
Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page of apps they were actually not allowed to access. Depending on the selection of apps installed this may present a permissions bypass. It is recommended that the Guests app is upgraded to 2.4.1, 2.5.1 or 3.0.1. There are no known workarounds for this vulnerability. • https://github.com/nextcloud/guests/pull/1082 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v3qw-7vgv-2fxj https://hackerone.com/reports/2251074 • CWE-281: Improper Preservation of Permissions •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2024-22401 – All users can reset the allowed apps list for Nextcloud Guest App users
https://notcve.org/view.php?id=CVE-2024-22401
Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users could change the allowed list of apps, allowing them to use apps that were not intended to be used. It is recommended that the Guests app is upgraded to 2.4.1, 2.5.1 or 3.0.1. There are no known workarounds for this vulnerability. La aplicación para invitados Nextcloud es una utilidad para crear usuarios invitados que solo pueden ver los archivos compartidos con ellos. • https://github.com/nextcloud/guests/pull/1082 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wr87-hx3w-29hh https://hackerone.com/reports/2250398 • CWE-281: Improper Preservation of Permissions •