CVE-2022-39211 Server-Side Request Forgery (SSRF) via potential filter bypass in Nextcloud Server

2022-09-1623:10:10

CWE-918

GitHub_M

www.cve.org

nextcloud server

ssrf

upgrade

webservices

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N

EPSS

0.001

Percentile

30.8%

JSON

Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erroneously. It is recommended that the Nextcloud Server is upgraded to 23.0.8 or 24.0.4. It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.10.4, 23.0.8 or 24.0.4. There are no known workarounds for this issue.

CNA Affected

[
  {
    "product": "security-advisories",
    "vendor": "nextcloud",
    "versions": [
      {
        "status": "affected",
        "version": "< 23.0.8"
      },
      {
        "status": "affected",
        "version": ">= 24.0.0, < 24.0.4"
      }
    ]
  }
]