CVE-2024-22212

Опубликовано: 18 янв. 2024

Источник: nvd

CVSS3: 9.6

CVSS3: 9.8

EPSS Низкий

Описание

Nextcloud Global Site Selector is a tool which allows you to run multiple small Nextcloud instances and redirect users to the right server. A problem in the password verification method allows an attacker to authenticate as another user. It is recommended that the Nextcloud Global Site Selector is upgraded to version 1.4.1, 2.1.2, 2.3.4 or 2.4.5. There are no known workarounds for this issue.

Ссылки

https://github.com/nextcloud/globalsiteselector/commit/ab5da57190d5bbc79079ce4109b6bcccccd893ee
Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vj5q-f63m-wp77
Patch
Vendor Advisory
https://hackerone.com/reports/2248689
Issue Tracking
Third Party Advisory
https://github.com/nextcloud/globalsiteselector/commit/ab5da57190d5bbc79079ce4109b6bcccccd893ee
Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vj5q-f63m-wp77
Patch
Vendor Advisory
https://hackerone.com/reports/2248689
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:nextcloud:global_site_selector:*:*:*:*:*:*:*:*

Версия от 1.1.0 (включая) до 1.4.1 (исключая)

cpe:2.3:a:nextcloud:global_site_selector:*:*:*:*:*:*:*:*

Версия от 2.0.0 (включая) до 2.1.2 (исключая)

cpe:2.3:a:nextcloud:global_site_selector:*:*:*:*:*:*:*:*

Версия от 2.2.0 (включая) до 2.3.4 (исключая)

cpe:2.3:a:nextcloud:global_site_selector:*:*:*:*:*:*:*:*

Версия от 2.4.0 (включая) до 2.4.5 (исключая)

EPSS

Процентиль: 78%

0.01151

Низкий

9.6 Critical

CVSS3

9.8 Critical

CVSS3

Дефекты

CWE-306

EPSS

Процентиль: 78%

0.01151

Низкий

9.6 Critical

CVSS3

9.8 Critical

CVSS3

Дефекты

CWE-306