CVE-2024-22404

Опубликовано: 18 янв. 2024

Источник: nvd

CVSS3: 4.1

CVSS3: 4.3

EPSS Низкий

Описание

Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to upgrade should disable the file zip app.

Ссылки

https://github.com/nextcloud/files_zip/commit/43204539d517a13e945b90652718e2a213f46820
Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vhj3-mch4-67fq
Vendor Advisory
https://hackerone.com/reports/2247457
Permissions Required
Third Party Advisory
https://github.com/nextcloud/files_zip/commit/43204539d517a13e945b90652718e2a213f46820
Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vhj3-mch4-67fq
Vendor Advisory
https://hackerone.com/reports/2247457
Permissions Required
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:nextcloud:zipper:*:*:*:*:*:*:*:*

Версия до 1.2.1 (исключая)

cpe:2.3:a:nextcloud:zipper:1.4.0:*:*:*:*:*:*:*

EPSS

Процентиль: 68%

0.00584

Низкий

4.1 Medium

CVSS3

4.3 Medium

CVSS3

Дефекты

CWE-281

EPSS

Процентиль: 68%

0.00584

Низкий

4.1 Medium

CVSS3

4.3 Medium

CVSS3

Дефекты

CWE-281