Nextcloud Security Advisories vulnerabilities, page 5

260 vulnerabilities

Known vulnerabilities in Nextcloud Security Advisories, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.5MediumCVE-2022-41926nextcloud · security-advisories +1 moreNextcloud Talk Android broadcast incorrect permission handlingNextcould talk android is the android OS implementation of the nextcloud talk chat system. In affected versions the receiver is not protected by broadcastPermission allowing malicious apps to monitor communication. It is recommended that the Nextcloud Talk Android is upgraded to 14.1.0. There are no known workarounds for this issue.EPSS0.28%5.3MediumCVE-2022-41970nextcloud · nextcloud_server +1 moreNextcloud Server's disabled download shares still allow download through preview imagesNextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disabled download shares still allow download through preview images. Images could be downloaded and previews of documents (first page) can be downloaded without being watermarked. Versions 24.0.7 and 25.0.1 contain a fix for this issue. No known workarounds are available.EPSS0.65%5.4MediumCVE-2022-31131nextcloud · nextcloud_mail +1 moreOwnership check missing when updating or deleting mail attachments in Nextcloud mailNextcloud mail is a Mail app for the Nextcloud home server product. Versions of Nextcloud mail prior to 1.12.2 were found to be missing user account ownership checks when performing tasks related to mail attachments. Attachments may have been exposed to incorrect system users. It is recommended that the Nextcloud Mail app is upgraded to 1.12.2. There are no known workarounds for this issue. ### Workarounds No workaround available ### References * [Pull request](https://github.com/nextcloud/mail/pull/6600) * [HackerOne](https://hackerone.com/reports/1579820) ### For more information If you have any questions or comments about this advisory: * Create a post in [nextcloud/security-advisories](https://github.com/nextcloud/security-advisories/discussions) * Customers: Open a support ticket at [support.nextcloud.com](https://support.nextcloud.com)EPSS0.78%2.7LowCVE-2022-31120nextcloud · nextcloud_server +1 moreFederated share accepting/declining is not logged in audit log in Nextcloud ServerNextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incompletely populated. In affected versions federated share events were not properly logged which would allow brute force attacks to go unnoticed. This behavior exacerbates the impact of CVE-2022-31118. It is recommended that the Nextcloud Server is upgraded to 22.2.7, 23.0.4 or 24.0.0. There are no workarounds available.EPSS0.90%6.5MediumCVE-2022-31118nextcloud · nextcloud_server +1 moreMissing brute force protection on cloud federation sharing in Nextcloud ServerNextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing is being used and potentially try to brute force access tokens for federated shares (`a-zA-Z0-9` ^ 15). It is recommended that the Nextcloud Server is upgraded to 22.2.9, 23.0.6 or 24.0.2. Users unable to upgrade may disable federated sharing via the Admin Sharing settings in `index.php/settings/admin/sharing`.EPSS0.77%6.5MediumCVE-2022-31024nextcloud · richdocuments +1 moreFederated editing allows iframing remote servers by default in richdocumentsrichdocuments is the repository for NextCloud Collabra, the app for Nextcloud Office collaboration. Prior to versions 6.0.0, 5.0.4, and 4.2.6, a user could be tricked into working against a remote Office by sending them a federated share. richdocuments versions 6.0.0, 5.0.4 and 4.2.6 contain a fix for this issue. There are currently no known workarounds available.EPSS0.63%4.9MediumCVE-2022-31119nextcloud · mail +1 morePassword disclosure in log file in Nextcloud Mail AppNextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions of Nextcloud mail would log user passwords to disk in the event of a misconfiguration. Should an attacker gain access to the logs complete access to affected accounts would be obtainable. It is recommended that the Nextcloud Mail is upgraded to 1.12.1. Operators should inspect their logs and remove passwords which have been logged. There are no workarounds to prevent logging in the event of a misconfiguration.EPSS0.83%9.8CriticalCVE-2022-31132nextcloud · mail +1 moreUnauthenticated SSRF in 3rd party module "cerdic/csstidy"Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions shipped with a CSS minifier on the path `./vendor/cerdic/css-tidy/css_optimiser.php`. Access to the minifier is unrestricted and access may lead to Server-Side Request Forgery (SSRF). It is recommendet to upgrade to Mail 1.12.7 or Mail 1.13.6. Users unable to upgrade may manually delete the file located at `./vendor/cerdic/css-tidy/css_optimiser.php`EPSS0.72%5.4MediumCVE-2022-31014nextcloud · nextcloud_server +1 moreSMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud ServerNextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impact varies based on which commands are supported by the backend SMTP server. However, the main risk here is that the attacker can then hijack an already-authenticated SMTP session and run arbitrary SMTP commands as the email user, such as sending emails to other users, changing the FROM user, and so on. As before, this depends on the configuration of the server itself, but newlines should be sanitized to mitigate such arbitrary SMTP command injection. It is recommended that the Nextcloud Server is upgraded to 22.2.8 , 23.0.5 or 24.0.1. There are no known workarounds for this issue.EPSS2.51%7.5HighCVE-2022-36074nextcloud · nextcloud_enterprise_server +2 moreAuthentication headers exposed on by Nextcloud ServerNextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fails to strip the Authorization header on HTTP downgrade. This can lead to account access exposure and compromise. It is recommended that the Nextcloud Server is upgraded to 23.0.7 or 24.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.11, 23.0.7 or 24.0.3. There are no known workarounds for this issue.EPSS0.76%4.3MediumCVE-2022-36075nextcloud · files_access_control +1 moreFile list exposure in Nextcloud Files Access ControlNextcloud files access control is a nextcloud app to manage access control for files. Users with limited access can see file names in certain cases where they do not have privilege to do so. This issue has been addressed and it is recommended that the Nextcloud Files Access Control app is upgraded to 1.12.2, 1.13.1 or 1.14.1. There are no known workarounds for this issueEPSS0.57%4.3MediumCVE-2022-39339nextcloud · openid_connect_user_backend +1 moreCleartext Transmission of Sensitive Information in user_oidcuser_oidc is an OpenID Connect user backend for Nextcloud. In versions prior to 1.2.1 sensitive information such as the OIDC client credentials and tokens are sent in plain text of HTTP without TLS. Any malicious actor with access to monitor user traffic may have been able to compromise account security. This issue has been addressed in in user_oidc v1.2.1. Users are advised to upgrade. Users unable to upgrade may use https to access Nextcloud. Set an HTTPS discovery URL in the provider settings (in Nextcloud OIDC admin settings).EPSS0.46%6.1MediumCVE-2022-39333debian · nextcloud-desktop +3 moreCross-site scripting (XSS) in Nextcloud Desktop ClientNexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.EPSS0.94%5.3MediumCVE-2022-39212nextcloud · security-advisories +1 moreLast video frame is still sent after video is disabled in a call in Nextcloud TalkNextcloud Talk is an open source chat, video & audio calls client for the Nextcloud platform. In affected versions an attacker could see the last video frame of any participant who has video disabled but a camera selected. It is recommended that the Nextcloud Talk app is upgraded to 13.0.8 or 14.0.4. Users unable to upgrade should select "None" as camera before joining the call.EPSS0.68%4.8MediumCVE-2022-39330nextcloud · nextcloud_enterprise_server +2 moreDatabase resource exhaustion for logged-in users via sharee recommendations with circlesNextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server prior to versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server prior to versions 22.2.10, 23.0.10, and 24.0.6 are vulnerable to a logged-in attacker slowing down the system by generating a lot of database/cpu load. Nextcloud Server versions 23.0.10 and 24.0.6 and Nextcloud Enterprise Server versions 22.2.10, 23.0.10, and 24.0.6 contain patches for this issue. As a workaround, disable the Circles app.EPSS0.91%5.3MediumCVE-2022-39211nextcloud · nextcloud_enterprise_server +2 moreServer-Side Request Forgery (SSRF) via potential filter bypass in Nextcloud ServerNextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erroneously. It is recommended that the Nextcloud Server is upgraded to 23.0.8 or 24.0.4. It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.10.4, 23.0.8 or 24.0.4. There are no known workarounds for this issue.EPSS0.96%5.4MediumCVE-2022-39338nextcloud · openid_connect_user_backend +1 moreStored cross site scripting (XSS) vulnerability via Authorization Endpoint in user_oidcuser_oidc is an OpenID Connect user backend for Nextcloud. Versions prior to 1.2.1 did not properly validate discovery urls which may lead to a stored cross site scripting attack vector. The impact is limited due to the restrictive CSP that is applied on this endpoint. Additionally this vulnerability has only been shown to be exploitable in the Safari web browser. This issue has been addressed in version 1.2.1. Users are advised to upgrade. Users unable to upgrade should urge their users to avoid using the Safari web browser.EPSS0.63%6.5MediumCVE-2022-39346fedoraproject · fedora +3 moreMissing length validation of user displayname in nextcloud serverNextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue.EPSS1.07%6.5MediumCVE-2022-39364nextcloud · nextcloud_enterprise_server +2 moreException logging in Sharepoint app reveals clear-text connection detailsNextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server prior to versions 23.0.9 and 24.0.5 and Nextcloud Enterprise Server prior to versions 22.2.10.5, 23.0.9, and 24.0.5 an attacker reading `nextcloud.log` may gain knowledge of credentials to connect to a SharePoint service. Nextcloud Server versions 23.0.9 and 24.0.5 and Nextcloud Enterprise Server versions 22.2.10.5, 23.0.9, and 24.0.5 contain a patch for this issue. As a workaround, set `zend.exception_ignore_args = On` as an option in `php.ini`.EPSS0.50%5.4MediumCVE-2022-39331debian · nextcloud-desktop +3 moreCross-site Scripting (XSS) in Nexcloud Desktop ClientNexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application in the notifications. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.EPSS0.96%