VulnerabilityModified
CVE-2024-22402
In affected versions users were able to load the first page of apps they were actually not allowed to access.
MEDIUM 5.4EPSS 0.51%
Does this matter?
Lower severity and a low EPSS score (0.51%). Track it; it rarely justifies an emergency change on its own.
Description
Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page of apps they were actually not allowed to access. Depending on the selection of apps installed this may present a permissions bypass. It is recommended that the Guests app is upgraded to 2.4.1, 2.5.1 or 3.0.1. There are no known workarounds for this vulnerability.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- EPSS
- 0.51% probability · 42th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-281
- Affected
- nextcloud/guests
- Source
- security-advisories@github.com
References
- https://github.com/nextcloud/guests/pull/1082Patch, Vendor Advisory
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v3qw-7vgv-2fxjVendor Advisory
- https://hackerone.com/reports/2251074Permissions Required, Third Party Advisory
- https://github.com/nextcloud/guests/pull/1082Patch, Vendor Advisory
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v3qw-7vgv-2fxjVendor Advisory
- https://hackerone.com/reports/2251074Permissions Required, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.