CVE-2022-39334 nextcloudcmd incorrectly trusts bad TLS certificates
Nextcloud CLI incorrectly trusts invalid TLS certificates, allowing Man-in-the-Middle attacks to expose sensitive data and credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-39334?
CVE-2022-39334 is a low-severity vulnerability in nextcloud security-advisories, published on 25 Nov 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS certificates, which may enable a Man-in-the-middle attack that exposes sensitive data or credentials to a network attacker. This affects the CLI only. It does not affect the standard GUI desktop Nextcloud clients, and it does not affect the Nextcloud server.
Weakness: CWE-295
Which versions are affected by CVE-2022-39334?
It affects 1 product.
Products include Nextcloud Desktop.
How do I fix CVE-2022-39334?
Upgrade to a fixed version.
Is CVE-2022-39334 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-39334 exists.
Other vulnerabilities in nextcloud security-advisories
- CVE-2024-46958 Misconfiguration in n/a
- CVE-2020-8224 Code injection in Desktop Client
- CVE-2020-8225 Information disclosure in Desktop Client
- CVE-2021-37617 Untrusted Search Path in Nextcloud Desktop Client
- CVE-2023-28999 Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders
Sources
Also known as DEBIAN-CVE-2022-39334, GHSA-82xx-98xv-4jxv, UBUNTU-CVE-2022-39334.