by Kastro
Paper/Archive/CVE-2024-22212

CVE-2024-22212

nextcloud security-advisories — Nextcloud global site selector authentication bypass

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 55.1.551 × 2011.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Nextcloud Global Site Selector is a tool which allows you to run multiple small Nextcloud instances and redirect users to the right server. A problem in the password verification method allows an attacker to authenticate as another user. It is recommended that the Nextcloud Global Site Selector is upgraded to version 1.4.1, 2.1.2, 2.3.4 or 2.4.5. There are no known workarounds for this issue.

Affected

ProductAffectedFixed inSource
security-advisories>= 1.1.0, < 1.4.1–CNA
security-advisories>= 2.0.0, < 2.1.2–CNA
security-advisories>= 2.2.0, < 2.3.4–CNA
security-advisories>= 2.4.0, < 2.4.5–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)9.7CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/nextcloud/security-advisories/security/advisories/GHSA-vj5q-f63m-wp77refgithub.com/nextcloud/globalsiteselector/commit/ab5da57190d5bbc79079ce4109b6bcccccd893eerefhackerone.com/reports/2248689