PT-2022-24812 · Nextcloud+1 · Nextcloud Server+2

Nickvergessen · Published 2022-08-26 · Updated 2022-09-21 · CVE-2022-39211

Positive Technologies (AI Summary)

CVSS v3.1

3.0

Low

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 23.0.8 Nextcloud Server versions prior to 24.0.4 Nextcloud Enterprise Server versions prior to 22.2.10.4 Nextcloud Enterprise Server versions prior to 23.0.8 Nextcloud Enterprise Server versions prior to 24.0.4

Description The issue concerns locally running webservices that can be found and requested erroneously. There are no known workarounds for this issue.

Recommendations For Nextcloud Server versions prior to 23.0.8, upgrade to 23.0.8 or 24.0.4. For Nextcloud Enterprise Server versions prior to 22.2.10.4, upgrade to 22.2.10.4, 23.0.8 or 24.0.4. For Nextcloud Enterprise Server versions prior to 23.0.8, upgrade to 23.0.8 or 24.0.4. For Nextcloud Enterprise Server versions prior to 24.0.4, upgrade to 24.0.4.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

ALT-PU-2022-2504

ALT-PU-2022-2555

CVE-2022-39211

GHSA-RMF9-W497-8CQ8

Affected Products

Alt Linux

Nextcloud Enterprise Server

Nextcloud Server

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39211.json · Exploit
• https://github.com/nextcloud/server/pull/32988 · Patch
• https://github.com/nextcloud/server/pull/33031 · Patch
• https://osv.dev/vulnerability/CVE-2022-39211 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39211 · Security Note
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-rmf9-w497-8cq8 · Note