Lucene search

NextcloudGHSA-RMF9-W497-8CQ8

HistorySep 16, 2022 - 4:51 a.m.

Server-Side Request Forgery (SSRF) via potential filter bypass with too lax local domain checking

2022-09-1604:51:33

github.com

ssrf

nextcloud

webservices

security bypass

upgrade

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

30.8%

JSON

Description

Impact

Locally running webservices can be found and requested

Patches

It is recommended that the Nextcloud Server is upgraded to 23.0.8 or 24.0.4.
It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.10.4, 23.0.8 or 24.0.4.

Workarounds

No workaround available

References

For more information

If you have any questions or comments about this advisory:

Create a post in nextcloud/security-advisories
Customers: Open a support ticket at support.nextcloud.com

References

github.com/nextcloud/server/pull/32988

github.com/nextcloud/server/pull/33031

hackerone.com/reports/1608039

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

30.8%

JSON

Related for GHSA-RMF9-W497-8CQ8