CVE-2022-24906: nextcloud deck
Vulnerability summary
CVE-2022-24906 is a medium (CVSS 4.3) vulnerability in nextcloud deck. EPSS estimates a 1.08% chance of exploitation in the next 30 days, higher than 64.6% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 20-05-2022PublishedVulnerability first disclosed.
- 22-04-2025Last modifiedVulnerability information updated.
Description
Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud, similar to Trello. The full path of the application is exposed to unauthorized users. It is recommended that the Nextcloud Deck app is upgraded to 1.2.11, 1.4.6, or 1.5.4. There is no workaround available.
CVSS metrics
3 scores · 2 sources · 2 versions- CVE.orgCNA3.5LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:NDiffers
EPSS trend
Probability
1.08%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
+0.02 pp
From 1.06% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundSecurity Advisories
Maturity: poc
Exploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-209Generation of Error Message Containing Sensitive InformationThe product generates an error message that includes sensitive information about its environment, users, or associated data.
Affected systems
Nextcloud2 products
- deck< 1.2.11 | ≥ 1.4.0, < 1.4.6 | ≥ 1.5.0, < 1.5.4
- security-advisories< 1.2.11 | ≥ 1.4.0, < 1.4.6 | ≥ 1.5.0, < 1.5.4
1 vendor · 2 products
References
3 links- github.com/nextcloud/security-advisories/security/advisories/GHSA-hx9w-xfrg-2qvpX Refsource CONFIRMExploitIssue TrackingThird Party Advisory