CVE-2022-24889: nextcloud server

csirt@kutim:~/threat-intel/cve/CVE-2022-24889

CVSS 4.3 · Medium EPSS 0,66%

Kerentanan Insufficient Verification of Data Authenticity pada nextcloud server. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 21.0.8, 22.2.4, and 23.0.1, it is possible to trick administrators into enabling "recommended" apps for the Nextcloud server that they do not need, thus expanding their attack surface unnecessarily. This issue is fixed in versions 21.0.8 , 22.2.4, and 23.0.1.

Rincian

Terbit di NVD: 27 April 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-345: Insufficient Verification of Data Authenticity
EPSS (30 hari): 0,66% peluang dieksploitasi; lebih tinggi dari 50,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
nextcloud	nextcloud server	Semua versi sebelum 21.0.8
nextcloud	nextcloud server	Versi 22.0.0 hingga sebelum 22.2.4
nextcloud	nextcloud server	Versi 23.0.0 hingga sebelum 23.0.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5vw6-6prg-gvw6 advisory pihak ketiga
https://github.com/nextcloud/server/pull/30615 advisory pihak ketiga
https://hackerone.com/reports/1403614 exploit · advisory pihak ketiga
https://security.gentoo.org/glsa/202208-17 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.