CVE-2022-39364 Exception logging in Sharepoint app reveals clear-text connection details
Attackers with log access can read clear-text SharePoint credentials from Nextcloud Server exception logs, requiring a patch or configuration change.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-39364?
CVE-2022-39364 is a medium-severity vulnerability in Nextcloud Nextcloud Server, published on 27 Oct 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server prior to versions 23.0.9 and 24.0.5 and Nextcloud Enterprise Server prior to versions 22.2.10.5, 23.0.9, and 24.0.5 an attacker reading `nextcloud.log` may gain knowledge of credentials to connect to a SharePoint service. Nextcloud Server versions 23.0.9 and 24.0.5 and Nextcloud Enterprise Server versions 22.2.10.5, 23.0.9, and 24.0.5 contain a patch for this issue. As a workaround, set `zend.exception_ignore_args = On` as an option in `php.ini`.
Weakness: CWE-312
Which versions are affected by CVE-2022-39364?
It affects 2 products.
Products include Nextcloud Nextcloud Enterprise Server, Nextcloud Nextcloud Server.
How do I fix CVE-2022-39364?
No fix has been published for CVE-2022-39364 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-39364 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-39364 exists.
Other vulnerabilities in Nextcloud Nextcloud Server
- CVE-2022-36074 Authentication headers exposed on by Nextcloud Server
- CVE-2022-39330 Database resource exhaustion for logged-in users via sharee recommendations with circles
- CVE-2022-39329 Profile of disabled user stays accessible
- CVE-2022-39211 Server-Side Request Forgery (SSRF) via potential filter bypass in Nextcloud Server
Sources
Also known as GHSA-qpf5-jj85-36h5.