Bug 2259121 (CVE-2024-22402) - CVE-2024-22402 nextcloud: users were able to load the first page of apps they were actually not allowed to access
Summary: CVE-2024-22402 nextcloud: users were able to load the first page of apps they...
Keywords:
Status: NEW
Alias: CVE-2024-22402
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2259122 2259123 2259124 2259125 2259126 2259127 2259128
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-01-19 08:08 UTC by Rohit Keshri
Modified: 2024-01-19 08:10 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Rohit Keshri 2024-01-19 08:08:48 UTC 
Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page of apps they were actually not allowed to access. However subsequent API calls all failed correctly, so in most apps no additional information was leaked. Depending on the selection of apps installed this may present a permissions bypass. It is recommended that the Guests app is upgraded to 2.4.1, 2.5.1 or 3.0.1. There are no known workarounds for this vulnerability.

https://github.com/nextcloud/guests/pull/1082
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v3qw-7vgv-2fxj
https://hackerone.com/reports/2251074
Comment 1 Rohit Keshri 2024-01-19 08:10:49 UTC 
Created nextcloud tracking bugs for this issue:

Affects: fedora-all [bug 2259122]


Created nextcloud:23/nextcloud tracking bugs for this issue:

Affects: epel-all [bug 2259123]
Affects: fedora-all [bug 2259126]


Created nextcloud:24/nextcloud tracking bugs for this issue:

Affects: epel-all [bug 2259124]
Affects: fedora-all [bug 2259127]


Created nextcloud:nextcloud-22/nextcloud tracking bugs for this issue:

Affects: epel-all [bug 2259125]


Created nextcloud:nextcloud-stable/nextcloud tracking bugs for this issue:

Affects: fedora-all [bug 2259128]
Note You need to log in before you can comment on or make changes to this bug.