CVE-2024-22212
Nextcloud Global Site Selector is a tool which allows you to run multiple small Nextcloud instances and redirect users to the right server.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.76%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Nextcloud Global Site Selector is a tool which allows you to run multiple small Nextcloud instances and redirect users to the right server. A problem in the password verification method allows an attacker to authenticate as another user. It is recommended that the Nextcloud Global Site Selector is upgraded to version 1.4.1, 2.1.2, 2.3.4 or 2.4.5. There are no known workarounds for this issue.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.76% probability · 53th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-306
- Affected
- nextcloud/global site selector
- Source
- security-advisories@github.com
References
- https://github.com/nextcloud/globalsiteselector/commit/ab5da57190d5bbc79079ce4109b6bcccccd893eePatch
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vj5q-f63m-wp77Patch, Vendor Advisory
- https://hackerone.com/reports/2248689Issue Tracking, Third Party Advisory
- https://github.com/nextcloud/globalsiteselector/commit/ab5da57190d5bbc79079ce4109b6bcccccd893eePatch
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vj5q-f63m-wp77Patch, Vendor Advisory
- https://hackerone.com/reports/2248689Issue Tracking, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.