Lucene search

NextcloudGHSA-8F3P-RCM5-MRG3

HistoryOct 27, 2022 - 6:53 a.m.

Profile of disabled user stays accessible

2022-10-2706:53:08

github.com

nextcloud

database access

upgrades

information exposure

vulnerability management

hackerone

pullrequest

security advisories

support ticket

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

30.8%

JSON

Description

Impact

Exposure of information that can not be controlled by administrators without direct database access.

Patches

It is recommended that the Nextcloud Server is upgraded to 23.0.9 or 24.0.5
It is recommended that the Nextcloud Enterprise Server is upgraded to 23.0.9 or 24.0.5

Workarounds

No workaround available

References

For more information

If you have any questions or comments about this advisory:

Create a post in nextcloud/security-advisories
Customers: Open a support ticket at support.nextcloud.com

References

github.com/nextcloud/server/pull/33643

hackerone.com/reports/1675014

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

30.8%

JSON

Related for GHSA-8F3P-RCM5-MRG3