Lucene search

GitHub_MCVELIST:CVE-2022-36075

HistorySep 15, 2022 - 9:50 p.m.

CVE-2022-36075 File list exposure in Nextcloud Files Access Control

2022-09-1521:50:10

CWE-200

GitHub_M

www.cve.org

nextcloud

access control

file list exposure

2.6 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N

4.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.5%

JSON

Nextcloud files access control is a nextcloud app to manage access control for files. Users with limited access can see file names in certain cases where they do not have privilege to do so. This issue has been addressed and it is recommended that the Nextcloud Files Access Control app is upgraded to 1.12.2, 1.13.1 or 1.14.1. There are no known workarounds for this issue

CNA Affected

[
  {
    "product": "security-advisories",
    "vendor": "nextcloud",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.12.2"
      },
      {
        "status": "affected",
        "version": ">= 1.13.0, < 1.13.1"
      },
      {
        "status": "affected",
        "version": ">= 1.14.0, < 1.14.1"
      }
    ]
  }
]

References

github.com/nextcloud/files_accesscontrol/pull/248

github.com/nextcloud/security-advisories/security/advisories/GHSA-4m73-g7v7-v62w

2.6 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N

4.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.5%

JSON

Related for CVELIST:CVE-2022-36075