CVE-2022-24889 : Nextcloud Server is the file server software for Nextcloud, a self-hosted produc

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 21.0.8, 22.2.4, and 23.0.1, it is possible to trick administrators into enabling "recommended" apps for the Nextcloud server that they do not need, thus expanding their attack surface unnecessarily. This issue is fixed in versions 21.0.8 , 22.2.4, and 23.0.1.

Published 2022-04-27 15:15:09

Updated 2022-10-25 20:51:55

Source GitHub, Inc.

View at NVD, CVE.org

Products affected by CVE-2022-24889

Nextcloud » Nextcloud Server
Versions before (<) 21.0.8
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
Matching versions
Nextcloud » Nextcloud Server
Versions from including (>=) 22.0.0 and before (<) 22.2.4
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
Matching versions
Nextcloud » Nextcloud Server
Versions from including (>=) 23.0.0 and before (<) 23.0.1
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-24889

EPSS FAQ

0.13%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 48 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-24889

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	2.8	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: Low Availability: None
2.4	LOW	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N	0.9	1.4	GitHub, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

CWE ids for CVE-2022-24889

CWE-345 Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Assigned by:
- nvd@nist.gov (Secondary)
- security-advisories@github.com (Primary)

References for CVE-2022-24889

https://github.com/nextcloud/server/pull/30615

Improve install process by Pytal · Pull Request #30615 · nextcloud/server · GitHub
Third Party Advisory
https://hackerone.com/reports/1403614

Sign in
Exploit;Third Party Advisory
https://security.gentoo.org/glsa/202208-17

Nextcloud: Multiple Vulnerabilities (GLSA 202208-17) — Gentoo security
Third Party Advisory

CVEs referencing this url
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5vw6-6prg-gvw6

Force an admin to install recommended applications · Advisory · nextcloud/security-advisories · GitHub
Third Party Advisory

Jump to

Vulnerability Details : CVE-2022-24889

Products affected by CVE-2022-24889

Exploit prediction scoring system (EPSS) score for CVE-2022-24889

CVSS scores for CVE-2022-24889

CWE ids for CVE-2022-24889

References for CVE-2022-24889