PT-2022-24931 · Nextcloud+2 · Nextcloud Server+3

Kichernde_Erbse

·

Published

2022-10-27

·

Updated

2023-01-16

·

CVE-2022-39364

CVSS v3.1

4.0

Medium

VectorAV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 23.0.9 and 24.0.5 Nextcloud Enterprise Server versions prior to 22.2.10.5, 23.0.9, and 24.0.5
Description The issue affects Nextcloud Server, a file server software for the self-hosted productivity platform Nextcloud. An attacker reading nextcloud.log may gain knowledge of credentials to connect to a SharePoint service.
Recommendations For Nextcloud Server versions prior to 23.0.9, update to version 23.0.9 or later. For Nextcloud Server versions prior to 24.0.5, update to version 24.0.5 or later. For Nextcloud Enterprise Server versions prior to 22.2.10.5, update to version 22.2.10.5 or later. For Nextcloud Enterprise Server versions prior to 23.0.9, update to version 23.0.9 or later. For Nextcloud Enterprise Server versions prior to 24.0.5, update to version 24.0.5 or later. As a temporary workaround for all affected versions, set zend.exception ignore args = On as an option in php.ini.

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

ALT-PU-2022-2949
ALT-PU-2023-1056
CVE-2022-39364
GHSA-QPF5-JJ85-36H5

Affected Products

Alt Linux
Nextcloud Enterprise Server
Nextcloud Server
Sharepoint Server