CVE-2022-24889

🗓️ 27 Apr 2022 14:35:13Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 117 Views

Nextcloud Server prior to versions 21.0.8, 22.2.4, and 23.0.1 allows attackers to expand attack surface by tricking administrators into enabling unnecessary apps

Reporter	Title	Published	Views	Family All 30
Circl	CVE-2022-24889	27 Apr 202218:13	–	circl
CNNVD	Nextcloud 数据伪造问题漏洞	27 Apr 202200:00	–	cnnvd
Cvelist	CVE-2022-24889 Insufficient Verification of Data Authenticity in Nextcloud Server	27 Apr 202214:35	–	cvelist
EUVD	EUVD-2022-29657	3 Oct 202520:07	–	euvd
Tenable Nessus	GLSA-202208-17 : Nextcloud: Multiple Vulnerabilities	16 Aug 202200:00	–	nessus
Nextcloud	Force an admin to install recommended applications	27 Apr 202207:27	–	nextcloud
Gentoo Linux	Nextcloud: Multiple Vulnerabilities	10 Aug 202200:00	–	gentoo
Hacker One	Nextcloud: Possibility to force an admin to install recommended applications	18 Nov 202100:00	–	hackerone
Mend	CVE-2022-24889	27 Apr 202214:35	–	mend
NVD	CVE-2022-24889	27 Apr 202215:15	–	nvd

NVD

Vulners

Node

nextcloud nextcloud_serverRange<21.0.8

nextcloud nextcloud_serverRange22.0.0–22.2.4

nextcloud nextcloud_serverRange23.0.0–23.0.1

[
  {
    "product": "security-advisories",
    "vendor": "nextcloud",
    "versions": [
      {
        "status": "affected",
        "version": "< 21.0.8"
      },
      {
        "status": "affected",
        "version": "< 22.2.4"
      },
      {
        "status": "affected",
        "version": "< 23.0.1"
      }
    ]
  }
]

Source	Link
security	www.security.gentoo.org/glsa/202208-17
github	www.github.com/nextcloud/security-advisories/security/advisories/GHSA-5vw6-6prg-gvw6
github	www.github.com/nextcloud/server/pull/30615
hackerone	www.hackerone.com/reports/1403614

17 Jun 2026 04:32Current

4.2Medium risk

Vulners AI Score4.2

CVSS 3.12.4 - 4.3

CVSS 24.3

EPSS0.00656

SSVC

CWE-345