PT-2022-16844 · Nextcloud+1 · Nextcloud Server+1

Fancycode · Published 2022-03-09 · Updated 2023-06-30 · CVE-2022-24741

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 21.0.8 Nextcloud Server versions prior to 22.2.4 Nextcloud Server versions prior to 23.0.1

Description The issue affects Nextcloud server, an open source, self-hosted cloud style services platform. An attacker can cause a denial of service by uploading specially crafted files, which will cause the server to allocate too much memory or CPU.

Recommendations For versions prior to 21.0.8, upgrade to 21.0.8 or later. For versions prior to 22.2.4, upgrade to 22.2.4 or later. For versions prior to 23.0.1, upgrade to 23.0.1 or later. As a temporary workaround for users unable to upgrade, consider disabling preview generation with the enable previews config flag.

Exploit

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

ALT-PU-2022-2504

ALT-PU-2022-2555

CVE-2022-24741

GHSA-JF3H-XF4Q-MH89

Affected Products

Alt Linux

Nextcloud Server

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24741.json · Exploit
• 🔥 https://hackerone.com/reports/1261225 · Exploit
• https://github.com/nextcloud/server/pull/30291 · Patch
• https://osv.dev/vulnerability/CVE-2022-24741 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24741 · Security Note
• https://security.gentoo.org/glsa/202208-17 · Vendor Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jf3h-xf4q-mh89 · Note
• https://t.me/cvenotify/53442 · Telegram Post
• https://t.me/cibsecurity/38630 · Telegram Post