PT-2022-16959 · Nextcloud+1 · Nextcloud Server+1

Igorpyan · Published 2022-04-27 · Updated 2022-10-25 · CVE-2022-24889

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 21.0.8 Nextcloud Server versions prior to 22.2.4 Nextcloud Server versions prior to 23.0.1

Description The issue allows attackers to trick administrators into enabling unnecessary "recommended" apps for the Nextcloud server, expanding their attack surface.

Recommendations For versions prior to 21.0.8, update to version 21.0.8 or later. For versions prior to 22.2.4, update to version 22.2.4 or later. For versions prior to 23.0.1, update to version 23.0.1 or later.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

ALT-PU-2022-2504

ALT-PU-2022-2555

CVE-2022-24889

GHSA-5VW6-6PRG-GVW6

Affected Products

Alt Linux

Nextcloud Server

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24889.json · Exploit
• 🔥 https://hackerone.com/reports/1403614 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-24889 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24889 · Vendor Advisory
• https://security.gentoo.org/glsa/202208-17 · Vendor Advisory
• https://github.com/nextcloud/server/pull/30615 · Note
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5vw6-6prg-gvw6 · Note
• https://t.me/cibsecurity/41501 · Telegram Post