Medium severity · published Sep 16, 2022
CVE-2022-39211
Nextcloud server is an open source personal cloud platform
5.3
CVSS
1%
EPSS
No
On KEV
Description
Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erroneously. It is recommended that the Nextcloud Server is upgraded to 23.0.8 or 24.0.4. It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.10.4, 23.0.8 or 24.0.4. There are no known workarounds for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Nextcloud Enterprise Server · Nextcloud
before 22.2.10.4; 23.0.0 before 23.0.8; 24.0.0 before 24.0.4 · source: NVD
NS
Nextcloud Server · Nextcloud
before 23.0.8; 24.0.0 before 24.0.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-39211
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-39211
Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-rmf9-w497-8cq8
Patch
https://github.com/nextcloud/server/pull/32988
Patch
https://github.com/nextcloud/server/pull/33031
More from Nextcloud Enterprise Server
7.5
CVE-2022-36074
Nextcloud server is an open source personal cloud product
6.5
CVE-2022-39346
Nextcloud server is an open source personal cloud server
6.5
CVE-2022-39364
Exception logging in Sharepoint app reveals clear-text connection details
5.3
CVE-2022-39329
Profile of disabled user stays accessible
4.3
CVE-2022-39330
Database resource exhaustion for logged-in users via sharee recommendations with circles