VulnerabilityModified
CVE-2024-22401
In affected versions users could change the allowed list of apps, allowing them to use apps that were not intended to be used.
MEDIUM 4.3EPSS 0.46%
Does this matter?
Lower severity and a low EPSS score (0.46%). Track it; it rarely justifies an emergency change on its own.
Description
Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users could change the allowed list of apps, allowing them to use apps that were not intended to be used. It is recommended that the Guests app is upgraded to 2.4.1, 2.5.1 or 3.0.1. There are no known workarounds for this vulnerability.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 0.46% probability · 39th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-281
- Affected
- nextcloud/guests
- Source
- security-advisories@github.com
References
- https://github.com/nextcloud/guests/pull/1082Patch
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wr87-hx3w-29hhVendor Advisory
- https://hackerone.com/reports/2250398Permissions Required, Third Party Advisory
- https://github.com/nextcloud/guests/pull/1082Patch
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wr87-hx3w-29hhVendor Advisory
- https://hackerone.com/reports/2250398Permissions Required, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.