CVE-2022-24889

LOW

Nextcloud Server < 21.0.8 - Insufficient Verification of Data Authenticity

Title source: llm
STIX 2.1

Description

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 21.0.8, 22.2.4, and 23.0.1, it is possible to trick administrators into enabling "recommended" apps for the Nextcloud server that they do not need, thus expanding their attack surface unnecessarily. This issue is fixed in versions 21.0.8 , 22.2.4, and 23.0.1.

References (4)

Core 4
Core References
Third Party Advisory x_refsource_misc
https://github.com/nextcloud/server/pull/30615
Exploit, Third Party Advisory x_refsource_misc
https://hackerone.com/reports/1403614
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202208-17

Scores

CVSS v3 2.4
EPSS 0.0016
EPSS Percentile 36.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-345
Status published
Products (1)
nextcloud/nextcloud_server < 21.0.8
Published Apr 27, 2022
Tracked Since Feb 18, 2026