CVE-2022-39211 - Server-Side Request Forgery (SSRF) via potential filter bypass in Nextcloud Server

Back Back to CVE browser

MEDIUM

Server-Side Request Forgery (SSRF) via potential filter bypass in Nextcloud Server

Published Sep 16, 2022

5.3

MEDIUM

CVSS 3.1

EPSS 0.96%

Description

Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erroneously. It is recommended that the Nextcloud Server is upgraded to 23.0.8 or 24.0.4. It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.10.4, 23.0.8 or 24.0.4. There are no known workarounds for this issue.

Affected products

Vendor Nextcloud Product Security-Advisories Default
n/a
- Version
  < 23.0.8
  Status
  affected
  Constraints
  -
- Version
  >= 24.0.0, < 24.0.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Nextcloud

Security-Advisories

n/a

Version	Status	Constraints
< 23.0.8	affected	-
>= 24.0.0, < 24.0.4	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-918

SSRF

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-41750
Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-rmf9-w497-8cq8
x_refsource_CONFIRMThird Party Advisory
https://github.com/nextcloud/server/pull/32988
x_refsource_MISCPatchThird Party Advisory
https://github.com/nextcloud/server/pull/33031
x_refsource_MISCPatchThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-41750		Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-rmf9-w497-8cq8		x_refsource_CONFIRMThird Party Advisory
https://github.com/nextcloud/server/pull/32988		x_refsource_MISCPatchThird Party Advisory
https://github.com/nextcloud/server/pull/33031		x_refsource_MISCPatchThird Party Advisory