PT-2023-18524 · Nextcloud · Nextcloud Desktop Client

Nickvergessen · Published 2023-01-09 · Updated 2023-01-13 · CVE-2023-22472

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Nextcloud Desktop client versions prior to 3.6.2

Description The issue affects Deck, a kanban style organization tool integrated with Nextcloud, allowing an attacker to make a user send any POST request with an arbitrary body if they click on a malicious deep link on a Windows computer. This could be done through various means such as email or chat links. There are no known workarounds for this issue.

Recommendations For versions prior to 3.6.2, upgrade the Nextcloud Desktop client to version 3.6.2 to resolve the issue. As a temporary workaround, consider avoiding the use of deep links from untrusted sources until the upgrade is applied.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-22472

GHSA-4GFV-XQPX-42QJ

Affected Products

Nextcloud Desktop Client

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22472.json · Exploit
• https://github.com/nextcloud/desktop/pull/5106 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-22472 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22472 · Vendor Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4gfv-xqpx-42qj · Note
• https://t.me/cvenotify/41966 · Telegram Post
• https://t.me/cibsecurity/56153 · Telegram Post
• https://t.me/cvenotify/41560 · Telegram Post