PT-2024-19279 · Nextcloud · Nextcloud Global Site Selector

Ry0Tak · Published 2024-01-18 · Updated 2024-01-26 · CVE-2024-22212

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nextcloud Global Site Selector versions prior to 1.4.1 Nextcloud Global Site Selector versions prior to 2.1.2 Nextcloud Global Site Selector versions prior to 2.3.4 Nextcloud Global Site Selector versions prior to 2.4.5

Description The Nextcloud Global Site Selector is a tool that allows running multiple small Nextcloud instances and redirecting users to the right server. A problem in the password verification method allows an attacker to authenticate as another user.

Recommendations For versions prior to 1.4.1, upgrade to version 1.4.1. For versions prior to 2.1.2, upgrade to version 2.1.2. For versions prior to 2.3.4, upgrade to version 2.3.4. For versions prior to 2.4.5, upgrade to version 2.4.5. As a temporary workaround, consider disabling the password verification function until a patch is available.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2024-22212

GHSA-VJ5Q-F63M-WP77

Affected Products

Nextcloud Global Site Selector

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22212.json · Exploit
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vj5q-f63m-wp77 · Vendor Advisory
• https://github.com/nextcloud/globalsiteselector/commit/ab5da57190d5bbc79079ce4109b6bcccccd893ee · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-22212 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22212 · Vendor Advisory
• https://hackerone.com/reports/2248689 · Note
• https://t.me/cvenotify/68833 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1748098237905453465 · Twitter Post
• https://twitter.com/CVEnew/status/1748063634905760124 · Twitter Post