PT-2022-20468 · Nextcloud · Nextcloud Office+1

Rtod · Published 2022-06-02 · Updated 2022-06-13 · CVE-2022-31024

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions richdocuments versions prior to 6.0.0 richdocuments versions prior to 5.0.4 richdocuments versions prior to 4.2.6

Description The issue affects NextCloud Collabra, the app for Nextcloud Office collaboration. A user could be tricked into working against a remote Office by sending them a federated share.

Recommendations For versions prior to 6.0.0, update to version 6.0.0 or later. For versions prior to 5.0.4, update to version 5.0.4 or later. For versions prior to 4.2.6, update to version 4.2.6 or later.

Exploit

Fix

Improper Access Control

Origin Validation Error

Weakness Enumeration

CWE-284

CWE-346

Related Identifiers

CVE-2022-31024

GHSA-94HR-7G4V-F53R

Affected Products

Nextcloud Collabra

Nextcloud Office

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31024.json · Exploit
• https://github.com/nextcloud/richdocuments/pull/2161 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31024 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31024 · Vendor Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-94hr-7g4v-f53r · Note
• https://t.me/cvenotify/31020 · Telegram Post
• https://hackerone.com/reports/1210424 · Note
• https://t.me/cibsecurity/43767 · Telegram Post