QwikSec

Security Database

CVE

CWE

Training

CVE-2022-39329

Published: Oct 27, 2022

Modified: Apr 23, 2025

PUBLISHED

CVSS v3.1

3.5

LOW

Description

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 23.0.9 and 24.0.5 are vulnerable to exposure of information that cannot be controlled by administrators without direct database access. Versions 23.0.9 and 24.0.5 contains patches for this issue. No known workarounds are available.

Vendor	Product	Versions
nextcloud	security-advisories	affected `< 23.0.9` affected `>= 24.0.0, < 24.0.5`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8f3p-rcm5-mrg3

https://github.com/nextcloud/server/pull/33643

https://hackerone.com/reports/1675014

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.