CVE-2022-24889 Insufficient Verification of Data Authenticity in Nextcloud Server
Attackers can trick administrators into enabling unnecessary recommended apps, expanding the attack surface of the Nextcloud server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-24889?
CVE-2022-24889 is a low-severity vulnerability in Nextcloud Nextcloud Server, published on 27 Apr 2022. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 21.0.8, 22.2.4, and 23.0.1, it is possible to trick administrators into enabling "recommended" apps for the Nextcloud server that they do not need, thus expanding their attack surface unnecessarily. This issue is fixed in versions 21.0.8 , 22.2.4, and 23.0.1.
Weakness: CWE-345
Which versions are affected by CVE-2022-24889?
It affects 1 product.
Products include Nextcloud Nextcloud Server.
How do I fix CVE-2022-24889?
No fix has been published for CVE-2022-24889 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-24889 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-24889 exists.
Other vulnerabilities in Nextcloud Nextcloud Server
- CVE-2021-32802 Preview generation used third-party library not suited for user-generated content in Nextcloud server
- CVE-2023-26482 Scope of workflow operations is not validated in nextcloud server
- CVE-2018-3775 Auth bypass in Nextcloud Server
- CVE-2023-35172 Nextcloud Server password reset endpoint is not brute force protected
- CVE-2023-32320 Nextcloud Server's brute force protection allows someone to send more requests than intended
Sources
Also known as GHSA-5vw6-6prg-gvw6.