PT-2022-16975 · Nextcloud · Nextcloud Deck

Ctulhu · Published 2022-05-20 · Updated 2023-07-06 · CVE-2022-24906

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Deck versions prior to 1.2.11 Nextcloud Deck versions prior to 1.4.6 Nextcloud Deck versions prior to 1.5.4

Description Nextcloud Deck is a Kanban-style project and personal management tool for Nextcloud, similar to Trello. The full path of the application is exposed to unauthorized users.

Recommendations For versions prior to 1.2.11, upgrade to 1.2.11. For versions prior to 1.4.6, upgrade to 1.4.6. For versions prior to 1.5.4, upgrade to 1.5.4.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Information Disclosure

Weakness Enumeration

CWE-209

CWE-200

Related Identifiers

CVE-2022-24906

GHSA-HX9W-XFRG-2QVP

Affected Products

Nextcloud Deck

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24906.json · Exploit
• 🔥 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hx9w-xfrg-2qvp · Exploit
• 🔥 https://hackerone.com/reports/1354334 · Exploit
• https://github.com/nextcloud/deck/pull/3384 · Patch
• https://osv.dev/vulnerability/CVE-2022-24906 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24906 · Security Note
• https://t.me/cibsecurity/43074 · Telegram Post
• https://t.me/cvenotify/53755 · Telegram Post