PT-2022-19420 · Nextcloud · Nextcloud Deck

Supr4S · Published 2022-05-20 · Updated 2022-06-02 · CVE-2022-29159

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Deck versions prior to 1.4.8 Nextcloud Deck versions prior to 1.5.6 Nextcloud Deck versions prior to 1.6.1

Description Nextcloud Deck is a Kanban-style project and personal management tool for Nextcloud. In affected versions, an authenticated user can move stacks with cards from their own board to a board of another user.

Recommendations For versions prior to 1.4.8, update to version 1.4.8 or later. For versions prior to 1.5.6, update to version 1.5.6 or later. For versions prior to 1.6.1, update to version 1.6.1 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2022-29159

GHSA-VQHF-673W-7R3J

Affected Products

Nextcloud Deck

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29159.json · Exploit
• 🔥 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vqhf-673w-7r3j · Exploit
• 🔥 https://hackerone.com/reports/1450117 · Exploit
• https://github.com/nextcloud/deck/pull/3541 · Patch
• https://osv.dev/vulnerability/CVE-2022-29159 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29159 · Security Note
• https://t.me/cibsecurity/43073 · Telegram Post