DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Nextcloud: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2022-11-27
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Nextcloud ausnutzen, um einen Denial of Service Angriff durchzuführen, Informationen offenzulegen, einen Cross-Site-Scripting-Angriff durchzuführen oder Sicherheitsvorkehrungen zu umgehen.
01
beschreibt (8)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-39333US | medium6.1 | — | ||
Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application. It is recommended that th… | ||||
| CVE-2022-39332US | medium5.4 | — | ||
Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application via user status and inform… | ||||
| CVE-2022-41926US | medium5.5 | — | ||
Nextcould talk android is the android OS implementation of the nextcloud talk chat system. In affected versions the receiver is not protected by broadcastPermission allowing malici… | ||||
| CVE-2022-39346US | medium6.5 | — | ||
Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to ove… | ||||
| CVE-2022-39339US | medium4.3OT erhöht | — | ||
user_oidc is an OpenID Connect user backend for Nextcloud. In versions prior to 1.2.1 sensitive information such as the OIDC client credentials and tokens are sent in plain text of… | ||||
| CVE-2022-39338US | medium5.4 | — | ||
user_oidc is an OpenID Connect user backend for Nextcloud. Versions prior to 1.2.1 did not properly validate discovery urls which may lead to a stored cross site scripting attack v… | ||||
| CVE-2022-39334US | medium4.7 | — | ||
Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrect… | ||||
| CVE-2022-39331US | medium5.4 | — | ||
Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application in the notifications. It i… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Nextcloud Desktop issue 4927external
- Github Nextcloud Advisory vom 2022-11-27external
- Github Nextcloud Advisory vom 2022-11-27external
- Github Nextcloud Advisory vom 2022-11-27external
- Github Nextcloud Advisory vom 2022-11-27external
- Github Nextcloud Advisory vom 2022-11-27external
- Github Nextcloud Advisory vom 2022-11-27external
- Github Nextcloud Advisory vom 2022-11-27external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan