Lucene search

[email protected]CVE-2024-30247

HistoryMar 29, 2024 - 4:15 p.m.

CVE-2024-30247

2024-03-2916:15:09

CWE-78

[email protected]

web.nvd.nist.gov

nextcloudpi

command injection

root access

authentication

web-panel

security misconfiguration

upgrade

nvd

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

7.6 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.7%

JSON

NextcloudPi is a ready to use image for Virtual Machines, Raspberry Pi, Odroid HC1, Rock64 and other boards. A command injection vulnerability in NextCloudPi allows command execution as the root user via the NextCloudPi web-panel. Due to a security misconfiguration this can be used by anyone with access to NextCloudPi web-panel, no authentication is required. It is recommended that the NextCloudPi is upgraded to 1.53.1.

Affected configurations

Vulners

Node

nextcloudnextcloudRange<1.53.1

VendorProductVersionCPE
nextcloudnextcloud*cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nextcloud	nextcloud	*	cpe:2.3:a:nextcloud:nextcloud::::::::

CNA Affected

[
  {
    "vendor": "nextcloud",
    "product": "nextcloudpi",
    "versions": [
      {
        "version": "< 1.53.1",
        "status": "affected"
      }
    ]
  }
]

References

github.com/nextcloud/nextcloudpi/security/advisories/GHSA-m597-72v7-j982

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

7.6 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.7%

JSON

Related for CVE-2024-30247

cvelist1 nvd1