CVE-2022-41970
01.12.2022, 21:15
Nextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disabled download shares still allow download through preview images. Images could be downloaded and previews of documents (first page) can be downloaded without being watermarked. Versions 24.0.7 and 25.0.1 contain a fix for this issue. No known workarounds are available.Enginsight
| Vendor | Product | Version |
|---|---|---|
| nextcloud | nextcloud_server | 24.0.0 ≤ 𝑥 < 24.0.7 |
| nextcloud | nextcloud_server | 24.0.0 ≤ 𝑥 < 24.0.7 |
| nextcloud | nextcloud_server | 25.0.0 |
| nextcloud | nextcloud_server | 25.0.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-284 - Improper Access ControlThe software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-863 - Incorrect AuthorizationThe software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
References