Skip to content
OpenAdvisories
Low WID-SEC-2022-2183 8 CVEs

Nextcloud: Mehrere Schwachstellen

Published Nov 27, 2022 · Updated Sep 17, 2025 · Revision 4 · de-DE

Vendor: Debian Vendor: Nextcloud Product: Linux Product: Nextcloud Platform: Android Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Nextcloud ausnutzen, um einen Denial of Service Angriff durchzuführen, Informationen offenzulegen, einen Cross-Site-Scripting-Angriff durchzuführen oder Sicherheitsvorkehrungen zu umgehen.

Product

Nextcloud ist eine "on-premise" Plattform für Dateifreigabe und Zusammenarbeit.

Vulnerabilities 8

  • Medium 4.6
    CVE-2022-39331

    Cross-site Scripting (XSS) in Nexcloud Desktop Client

    Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application in the notifications. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are…

    Nextcloud security-advisories nextcloud-desktop nextcloud-desktop Debian Ubuntu
  • Medium 4.6
    CVE-2022-39332

    Cross-site scripting (XSS) in Nextcloud Desktop Client

    Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application via user status and information. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1…

    Nextcloud security-advisories nextcloud-desktop nextcloud-desktop Debian Ubuntu
  • Medium 4.6
    CVE-2022-39333

    Cross-site scripting (XSS) in Nextcloud Desktop Client

    Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds…

    Nextcloud security-advisories nextcloud-desktop nextcloud-desktop Debian Ubuntu
  • Medium 4.3
    CVE-2022-39339

    Cleartext Transmission of Sensitive Information in user_oidc

    user_oidc is an OpenID Connect user backend for Nextcloud. In versions prior to 1.2.1 sensitive information such as the OIDC client credentials and tokens are sent in plain text of HTTP without TLS. Any malicious actor with access to monitor user traffic may …

    Nextcloud security-advisories
  • Low 3.9
    CVE-2022-39334

    nextcloudcmd incorrectly trusts bad TLS certificates

    Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS certificates, which may enable a Man-in-the-middle attack …

    Nextcloud security-advisories nextcloud-desktop nextcloud-desktop Debian Ubuntu
  • Low 3.5
    CVE-2022-39338

    Stored cross site scripting (XSS) vulnerability via Authorization Endpoint in user_oidc

    user_oidc is an OpenID Connect user backend for Nextcloud. Versions prior to 1.2.1 did not properly validate discovery urls which may lead to a stored cross site scripting attack vector. The impact is limited due to the restrictive CSP that is applied on this…

    Nextcloud security-advisories
  • Low 3.5
    CVE-2022-39346

    Missing length validation of user displayname in nextcloud server

    Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended tha…

    Nextcloud security-advisories
  • Low 3.3
    CVE-2022-41926

    Nextcloud Talk Android broadcast incorrect permission handling

    Nextcould talk android is the android OS implementation of the nextcloud talk chat system. In affected versions the receiver is not protected by broadcastPermission allowing malicious apps to monitor communication. It is recommended that the Nextcloud Talk An…

    Nextcloud security-advisories

Revision history

  1. #4

    Neue Updates von Debian aufgenommen

  2. #3

    PoC aufgenommen

  3. #2

    Referenz(en) aufgenommen: FEDORA-2022-49B20342C0, FEDORA-2022-902DF3B060, FEDORA-2022-98C1D712B5

  4. #1

    Initiale Fassung

References