PT-2022-16958 · Nextcloud+1 · Nextcloud Server+1

David_H1 · Published 2022-04-27 · Updated 2023-07-06 · CVE-2022-24888

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1

Description The issue allows creating files and folders with leading and trailing , r, t, and v characters. The server rejects these characters when they appear in the middle of file or folder names, which might provide an opportunity for injection.

Recommendations For versions prior to 20.0.14.4, update to version 20.0.14.4 or later. For versions prior to 21.0.8, update to version 21.0.8 or later. For versions prior to 22.2.4, update to version 22.2.4 or later. For versions prior to 23.0.1, update to version 23.0.1 or later.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

ALT-PU-2022-2504

ALT-PU-2022-2555

CVE-2022-24888

GHSA-W3H6-P64H-Q9JP

Affected Products

Alt Linux

Nextcloud Server

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24888.json · Exploit
• https://github.com/nextcloud/server/pull/29895 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24888 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24888 · Vendor Advisory
• https://security.gentoo.org/glsa/202208-17 · Vendor Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w3h6-p64h-q9jp · Note
• https://t.me/cibsecurity/41497 · Telegram Post
• https://t.me/cvenotify/53753 · Telegram Post
• https://hackerone.com/reports/1402249 · Note