High severity · published Sep 15, 2022
CVE-2022-36074
Nextcloud server is an open source personal cloud product
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
Nextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fails to strip the Authorization header on HTTP downgrade. This can lead to account access exposure and compromise. It is recommended that the Nextcloud Server is upgraded to 23.0.7 or 24.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.11, 23.0.7 or 24.0.3. There are no known workarounds for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Nextcloud Enterprise Server · Nextcloud
before 22.2.11; 23.0.0 before 23.0.7; 24.0.0 before 24.0.3 · source: NVD
NS
Nextcloud Server · Nextcloud
before 23.0.7; 24.0.0 before 24.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-36074
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-36074
Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vqgm-f748-g76v
Patch
https://github.com/nextcloud/server/pull/32941
More from Nextcloud Enterprise Server
6.5
CVE-2022-39346
Nextcloud server is an open source personal cloud server
6.5
CVE-2022-39364
Exception logging in Sharepoint app reveals clear-text connection details
5.3
CVE-2022-39329
Profile of disabled user stays accessible
5.3
CVE-2022-39211
Nextcloud server is an open source personal cloud platform
4.3
CVE-2022-39330
Database resource exhaustion for logged-in users via sharee recommendations with circles