Описание
Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider the user enumeration settings by the administrator. This allowed a user to enumerate other users on the instance, even when user listings where disabled. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. There are no known workarounds.
Ссылки
- Issue TrackingThird Party Advisory
- Issue TrackingPatchThird Party Advisory
- PatchThird Party Advisory
- Third Party Advisory
- Issue TrackingThird Party Advisory
- Issue TrackingPatchThird Party Advisory
- PatchThird Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 20.0.14 (исключая)Версия от 21.0.0 (включая) до 21.0.6 (исключая)
Одно из
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
cpe:2.3:a:nextcloud:nextcloud_server:22.2.0:*:*:*:*:*:*:*
EPSS
Процентиль: 69%
0.01248
Низкий
5.3 Medium
CVSS3
5 Medium
CVSS2
Дефекты
CWE-200
CWE-862
Связанные уязвимости
CVSS3: 5.3
debian
больше 4 лет назад
Nextcloud server is a self hosted system designed to provide cloud sty ...
CVSS3: 7.5
altlinux
около 4 лет назад
ALT-PU-2022-2555: package `nextcloud` update to version 24.0.4-alt2
CVSS3: 7.5
altlinux
около 4 лет назад
ALT-PU-2022-2504: package `nextcloud` update to version 24.0.4-alt1
EPSS
Процентиль: 69%
0.01248
Низкий
5.3 Medium
CVSS3
5 Medium
CVSS2
Дефекты
CWE-200
CWE-862