PT-2022-23163 · Nextcloud · Nextcloud Files Access Control App

Nickvergessen · Published 2022-09-15 · Updated 2022-09-19 · CVE-2022-36075

Positive Technologies (AI Summary)

CVSS v3.1

2.6

Low

Base vector

AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Files Access Control app versions prior to 1.12.2 Nextcloud Files Access Control app versions prior to 1.13.1 Nextcloud Files Access Control app versions prior to 1.14.1

Description The Nextcloud Files Access Control app has an issue where users with limited access can see file names in certain cases where they do not have the privilege to do so.

Recommendations For versions prior to 1.12.2, upgrade to 1.12.2. For versions prior to 1.13.1, upgrade to 1.13.1. For versions prior to 1.14.1, upgrade to 1.14.1.

Exploit

Fix

Improper Privilege Management

Information Disclosure

Weakness Enumeration

CWE-269

CWE-200

Related Identifiers

CVE-2022-36075

GHSA-4M73-G7V7-V62W

Affected Products

Nextcloud Files Access Control App

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36075.json · Exploit
• https://github.com/nextcloud/files_accesscontrol/pull/248 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-36075 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36075 · Vendor Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4m73-g7v7-v62w · Note
• https://t.me/cvenotify/36274 · Telegram Post
• https://t.me/cibsecurity/49858 · Telegram Post