CVE-2022-41970

2022-12-0121:15:19

CWE-863

CWE-284

[email protected]

web.nvd.nist.gov

nextcloud server

vulnerability

unauthorized download

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

30.9%

JSON

Nextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disabled download shares still allow download through preview images. Images could be downloaded and previews of documents (first page) can be downloaded without being watermarked. Versions 24.0.7 and 25.0.1 contain a fix for this issue. No known workarounds are available.

Affected configurations

Nvd

Node

nextcloudnextcloud_serverRange24.0.0–24.0.7

nextcloudnextcloud_serverRange24.0.0–24.0.7enterprise

nextcloudnextcloud_serverMatch25.0.0-

nextcloudnextcloud_serverMatch25.0.0enterprise

VendorProductVersionCPE
nextcloudnextcloud_server*cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
nextcloudnextcloud_server*cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*
nextcloudnextcloud_server25.0.0cpe:2.3:a:nextcloud:nextcloud_server:25.0.0:*:*:*:-:*:*:*
nextcloudnextcloud_server25.0.0cpe:2.3:a:nextcloud:nextcloud_server:25.0.0:*:*:*:enterprise:*:*:*

Vendor	Product	Version	CPE
nextcloud	nextcloud_server	*	cpe:2.3:a:nextcloud:nextcloud_server::::::::
nextcloud	nextcloud_server	*	cpe:2.3:a:nextcloud:nextcloud_server:::::enterprise:::*
nextcloud	nextcloud_server	25.0.0	cpe:2.3:a:nextcloud:nextcloud_server:25.0.0::::-:::
nextcloud	nextcloud_server	25.0.0	cpe:2.3:a:nextcloud:nextcloud_server:25.0.0::::enterprise:::