CVE-2022-24889 Information

Description

Nextcloud Server is the file server software for Nextcloud a self-hosted productivity platform. Prior to versions 21.0.8 22.2.4 and 23.0.1 it is possible to trick administrators into enabling ecommended\ apps for the Nextcloud server that they do not need thus expanding their attack surface unnecessarily. This issue is fixed in versions 21.0.8 22.2.4 and 23.0.1.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Reference

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5vw6-6prg-gvw6 https://github.com/nextcloud/server/pull/30615 https://hackerone.com/reports/1403614

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

LOW

Base Score

NONE

Base Severity

4.3