PT-2024-19392 · Nextcloud · Nextcloud Guests App

Ry0Tak · Published 2024-01-18 · Updated 2024-01-26 · CVE-2024-22401

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Guests app versions prior to 2.4.1 Nextcloud Guests app versions prior to 2.5.1 Nextcloud Guests app versions prior to 3.0.1

Description The Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions, users could change the allowed list of apps, allowing them to use apps that were not intended to be used.

Recommendations For versions prior to 2.4.1, upgrade to 2.4.1. For versions prior to 2.5.1, upgrade to 2.5.1. For versions prior to 3.0.1, upgrade to 3.0.1. As a temporary workaround, consider restricting access to the allowed list of apps until a patch is available.

Exploit

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2024-22401

GHSA-WR87-HX3W-29HH

Affected Products

Nextcloud Guests App

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22401.json · Exploit
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wr87-hx3w-29hh · Vendor Advisory
• https://github.com/nextcloud/guests/pull/1082 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-22401 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22401 · Vendor Advisory
• https://t.me/cvenotify/68835 · Telegram Post
• https://twitter.com/CVEnew/status/1748082316138754462 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1748143401613033626 · Twitter Post
• https://hackerone.com/reports/2250398 · Note