Skip to content
OpenAdvisories
High WID-SEC-2024-0155 6 CVEs

Nextcloud: Mehrere Schwachstellen

Published Jan 17, 2024 · Updated Apr 22, 2024 · Revision 3 · de-DE

Vendor: Fedora Vendor: Nextcloud Product: Linux Product: Nextcloud Platform: Linux

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Nextcloud Server und verschiedenen Apps ausnutzen, um Benutzerrechte zu erlangen, um den Benutzer zu täuschen und um Sicherheitsmechanismen zu umgehen.

Product

Nextcloud ist eine "on-premise" Plattform für Dateifreigabe und Zusammenarbeit.

Vulnerabilities 6

  • Critical 9.7
    CVE-2024-22212

    Nextcloud global site selector authentication bypass

    Nextcloud Global Site Selector is a tool which allows you to run multiple small Nextcloud instances and redirect users to the right server. A problem in the password verification method allows an attacker to authenticate as another user. It is recommended tha…

    Nextcloud security-advisories
  • Medium 5.4
    CVE-2024-22402

    Improper handling of request URLs in Nextcloud Guests app allows guest users to bypass app allowlist

    Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page of apps they were actually not allowed to access. Depending on the selection of apps installed this …

    Nextcloud security-advisories
  • Medium 4.1
    CVE-2024-22401

    All users can reset the allowed apps list for Nextcloud Guest App users

    Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users could change the allowed list of apps, allowing them to use apps that were not intended to be used. It is recommended that the Guests…

    Nextcloud security-advisories
  • Medium 4.1
    CVE-2024-22404

    Permissions bypass in Nextcloud with the files zip app

    Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1,…

    Nextcloud security-advisories
  • Low 3.1
    CVE-2024-22400

    Open redirect in user_saml via RelayState parameter in Nextcloud User Saml

    Nextcloud User Saml is an app for authenticating Nextcloud users using SAML. In affected versions users can be given a link to the Nextcloud server and end up on a uncontrolled thirdparty server. It is recommended that the User Saml app is upgraded to version…

    Nextcloud security-advisories
  • Low 3.0
    CVE-2024-22403

    OAuth2 authorization codes are valid indefinetly in Nextcloud server

    Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any time using the code. As of version 28.0.0 OAuth codes are inval…

    Nextcloud security-advisories

Revision history

  1. #3

    Neue Updates von Fedora aufgenommen

  2. #2

    Neue Updates von Fedora aufgenommen

  3. #1

    Initiale Fassung

References