Lucene search

GitHub_MCVELIST:CVE-2024-30247

HistoryMar 29, 2024 - 3:57 p.m.

CVE-2024-30247 Command Injection as root in NextCloudPi web panel

2024-03-2915:57:57

CWE-78

GitHub_M

www.cve.org

command injection

cve-2024-30247

nextcloudpi

root access

web panel

security misconfiguration

upgrade

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

10 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.8%

JSON

NextcloudPi is a ready to use image for Virtual Machines, Raspberry Pi, Odroid HC1, Rock64 and other boards. A command injection vulnerability in NextCloudPi allows command execution as the root user via the NextCloudPi web-panel. Due to a security misconfiguration this can be used by anyone with access to NextCloudPi web-panel, no authentication is required. It is recommended that the NextCloudPi is upgraded to 1.53.1.

CNA Affected

[
  {
    "vendor": "nextcloud",
    "product": "nextcloudpi",
    "versions": [
      {
        "version": "< 1.53.1",
        "status": "affected"
      }
    ]
  }
]

References

github.com/nextcloud/nextcloudpi/security/advisories/GHSA-m597-72v7-j982

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

10 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.8%

JSON

Related for CVELIST:CVE-2024-30247