CVE-2022-24906

Опубликовано: 20 мая 2022

Источник: nvd

CVSS3: 3.5

CVSS3: 4.3

CVSS2: 4

EPSS Низкий

Описание

Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud, similar to Trello. The full path of the application is exposed to unauthorized users. It is recommended that the Nextcloud Deck app is upgraded to 1.2.11, 1.4.6, or 1.5.4. There is no workaround available.

Ссылки

https://github.com/nextcloud/deck/pull/3384
Issue Tracking
Patch
Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hx9w-xfrg-2qvp
Exploit
Issue Tracking
Third Party Advisory
https://hackerone.com/reports/1354334
Exploit
Issue Tracking
Third Party Advisory
https://github.com/nextcloud/deck/pull/3384
Issue Tracking
Patch
Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hx9w-xfrg-2qvp
Exploit
Issue Tracking
Third Party Advisory
https://hackerone.com/reports/1354334
Exploit
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:nextcloud:deck:*:*:*:*:*:*:*:*

Версия до 1.2.11 (исключая)

cpe:2.3:a:nextcloud:deck:*:*:*:*:*:*:*:*

Версия от 1.4.0 (включая) до 1.4.6 (исключая)

cpe:2.3:a:nextcloud:deck:*:*:*:*:*:*:*:*

Версия от 1.5.0 (включая) до 1.5.4 (исключая)

EPSS

Процентиль: 50%

0.00269

Низкий

3.5 Low

CVSS3

4.3 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-200

CWE-209

EPSS

Процентиль: 50%

0.00269

Низкий

3.5 Low

CVSS3

4.3 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-200

CWE-209