CVE-2022-24889
Insufficient Verification of Data Authenticity in Nextcloud Server
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 21.0.8, 22.2.4, and 23.0.1, it is possible to trick administrators into enabling "recommended" apps for the Nextcloud server that they do not need, thus expanding their attack surface unnecessarily. This issue is fixed in versions 21.0.8 , 22.2.4, and 23.0.1.
Nextcloud Server es el software de servidor de archivos de Nextcloud, una plataforma de productividad autoalojada. En versiones anteriores a 21.0.8, 22.2.4 y 23.0.1, es posible engañar a los administradores para que habiliten aplicaciones "recommended" para el servidor Nextcloud que no necesitan, ampliando así su superficie de ataque innecesariamente. Este problema ha sido corregido en versiones 21.0.8 , 22.2.4 y 23.0.1
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-02-10 CVE Reserved
- 2022-04-27 CVE Published
- 2024-07-19 EPSS Updated
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-345: Insufficient Verification of Data Authenticity
CAPEC
References (4)
URL | Tag | Source |
---|---|---|
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5vw6-6prg-gvw6 | Third Party Advisory | |
https://github.com/nextcloud/server/pull/30615 | Third Party Advisory |
URL | Date | SRC |
---|---|---|
https://hackerone.com/reports/1403614 | 2024-08-03 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://security.gentoo.org/glsa/202208-17 | 2022-10-25 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Nextcloud Search vendor "Nextcloud" | Nextcloud Server Search vendor "Nextcloud" for product "Nextcloud Server" | < 21.0.8 Search vendor "Nextcloud" for product "Nextcloud Server" and version " < 21.0.8" | - |
Affected
| ||||||
Nextcloud Search vendor "Nextcloud" | Nextcloud Server Search vendor "Nextcloud" for product "Nextcloud Server" | >= 22.0.0 < 22.2.4 Search vendor "Nextcloud" for product "Nextcloud Server" and version " >= 22.0.0 < 22.2.4" | - |
Affected
| ||||||
Nextcloud Search vendor "Nextcloud" | Nextcloud Server Search vendor "Nextcloud" for product "Nextcloud Server" | >= 23.0.0 < 23.0.1 Search vendor "Nextcloud" for product "Nextcloud Server" and version " >= 23.0.0 < 23.0.1" | - |
Affected
|