Critical severity · published Jan 18, 2024
CVE-2024-22212
Nextcloud Global Site Selector is a tool which allows you to run multiple small Nextcloud instances and redirect users to the right server
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
Nextcloud Global Site Selector is a tool which allows you to run multiple small Nextcloud instances and redirect users to the right server. A problem in the password verification method allows an attacker to authenticate as another user. It is recommended that the Nextcloud Global Site Selector is upgraded to version 1.4.1, 2.1.2, 2.3.4 or 2.4.5. There are no known workarounds for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GS
Global Site Selector · Nextcloud
1.1.0 before 1.4.1; 2.0.0 before 2.1.2; 2.2.0 before 2.3.4; 2.4.0 before 2.4.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-22212
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-22212
Patch
https://github.com/nextcloud/globalsiteselector/commit/ab5da57190d5bbc79079ce4109b6bcccccd893ee
Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vj5q-f63m-wp77
Issue Tracking
https://hackerone.com/reports/2248689