Rullzer

Name of the Vulnerable Software and Affected Versions: Nextcloud Mail versions prior to 2.2.10 Nextcloud Mail versions prior to 3.6.2 Nextcloud Mail versions prior to 3.7.2 Description: The issue is related to insufficient access control in the Nextcloud mail client, allowing a remote attacker to disclose protected information. Specifically, the Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments, enabling users to send and download these files through their mail clients. Recommendations: For Nextcloud Mail versions prior to 2.2.10, upgrade to version 2.2.10 or later. For Nextcloud Mail versions prior to 3.6.2, upgrade to version 3.6.2 or later. For Nextcloud Mail versions prior to 3.7.2, upgrade to version 3.7.2 or later.

**Name of the Vulnerable Software and Affected Versions** Nextcloud versions prior to 25.0.8 Nextcloud versions prior to 26.0.3 Nextcloud versions prior to 27.0.1 **Description** The issue is related to the storage of OAuth2 tokens in plaintext in Nextcloud, allowing an attacker who has gained access to the server to potentially elevate their privilege. **Recommendations** For versions prior to 25.0.8, upgrade to version 25.0.8 or later. For versions prior to 26.0.3, upgrade to version 26.0.3 or later. For versions prior to 27.0.1, upgrade to version 27.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** user oidc versions 1.0.0 through 1.3.2 **Description** The issue affects the user oidc module, which provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. An attacker with at least read access to a snapshot of the database can impersonate the Nextcloud server towards linked servers. **Recommendations** For versions 1.0.0 through 1.3.2, update to version 1.3.3, which contains a patch for the issue. As a temporary workaround, consider restricting access to the database to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** user oidc versions 1.0.0 through 1.3.2 **Description** The issue is related to the missing verification of the issuer in the user oidc module for Nextcloud, allowing an attacker to perform a man-in-the-middle attack by returning corrupted or known tokens they have access to. **Recommendations** For versions prior to 1.3.3, update to version 1.3.3, which contains a patch for the issue. As a temporary workaround, consider restricting access to the OIDC connect user backend until the patch is applied.

**Name of the Vulnerable Software and Affected Versions** Nextcloud Server versions 24.0.4 through 25.0.8 Nextcloud Server versions 26.0.0 through 26.0.3 Nextcloud Server versions 27.0.0 through 27.0.0 **Description** Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. When a folder with images or an image was shared without download permissions, the user could add the image inline into a text file and download it. **Recommendations** For Nextcloud Server versions 24.0.4 through 25.0.8, update to version 25.0.9 or later. For Nextcloud Server versions 26.0.0 through 26.0.3, update to version 26.0.4 or later. For Nextcloud Server versions 27.0.0 through 27.0.0, update to version 27.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** Nextcloud Server versions 25.0.0 through 25.0.7 Nextcloud Server versions 26.0.0 through 26.0.2 Nextcloud Enterprise Server versions 21.0.0 through 21.0.9.12 Nextcloud Enterprise Server versions 22.0.0 through 22.2.10.12 Nextcloud Enterprise Server versions 23.0.0 through 23.0.12.7 Nextcloud Enterprise Server versions 24.0.0 through 24.0.12.2 Nextcloud Enterprise Server versions 25.0.0 through 25.0.7 Nextcloud Enterprise Server versions 26.0.0 through 26.0.2 **Description** The issue is related to the lack of protection against brute-force attacks during the password reset procedure in Nextcloud, a self-hosted productivity platform. This allows a remote attacker to exploit the vulnerability and gain unauthorized access by bruteforcing password reset links. **Recommendations** For Nextcloud Server versions 25.0.0 through 25.0.7, update to version 25.0.7 or later. For Nextcloud Server versions 26.0.0 through 26.0.2, update to version 26.0.2 or later. For Nextcloud Enterprise Server versions 21.0.0 through 21.0.9.12, update to version 21.0.9.12 or later. For Nextcloud Enterprise Server versions 22.0.0 through 22.2.10.12, update to version 22.2.10.12 or later. For Nextcloud Enterprise Server versions 23.0.0 through 23.0.12.7, update to version 23.0.12.7 or later. For Nextcloud Enterprise Server versions 24.0.0 through 24.0.12.2, update to version 24.0.12.2 or later. For Nextcloud Enterprise Server versions 25.0.0 through 25.0.7, update to version 25.0.7 or later. For Nextcloud Enterprise Server versions 26.0.0 through 26.0.2, update to version 26.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** Nextcloud End-to-end encryption app versions prior to 1.12.4 **Description** The Nextcloud End-to-end encryption app provides APIs for implementing End-to-End encryption on the client side. An issue exists where providing an invalid meta data file can make previously dropped files inaccessible. **Recommendations** For versions prior to 1.12.4, upgrade to version 1.12.4 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Nextcloud richdocuments versions prior to 6.3.2 Nextcloud richdocuments versions prior to 7.0.2 Nextcloud richdocuments versions prior to 8.0.0-beta.1 **Description** The secure view feature of the rich documents app can be bypassed by using an unprotected internal API endpoint of the rich documents app. This allows unauthorized access to sensitive documents. To mitigate the issue, users can restrict the ability to download documents by configuring the `WOPI configuration` to only serve documents between Nextcloud and Collabora. It is also recommended to define the list of Collabora server IPs as the allow list within the Office admin settings of Nextcloud. **Recommendations** For versions prior to 6.3.2, upgrade to 6.3.2 or later. For versions prior to 7.0.2, upgrade to 7.0.2 or later. For versions prior to 8.0.0-beta.1, upgrade to 8.0.0-beta.1 or later. As a temporary workaround, consider restricting the ability to download documents by configuring the `WOPI configuration` to only serve documents between Nextcloud and Collabora. Restrict access to the internal API endpoint of the rich documents app to minimize the risk of exploitation. Define the list of Collabora server IPs as the allow list within the Office admin settings of Nextcloud to further mitigate the issue.

**Name of the Vulnerable Software and Affected Versions** Nextcloud versions 24.0.4 through 24.0.6 Nextcloud versions 25.0.0 **Description** The issue is related to improper access control in Nextcloud, a private cloud software. This can allow a remote attacker to gain unauthorized access to limited functions. Specifically, the secure view for internal shares can be circumvented if reshare permissions are also given. **Recommendations** For Nextcloud versions 24.0.4 through 24.0.6, update to version 24.0.7 to resolve the issue. For Nextcloud versions 25.0.0, update to version 25.0.1 to resolve the issue.