CVE-2022-39211: nextcloud enterprise server +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2022-39211

CVSS 5.3 · Medium EPSS 0,96%

Kerentanan Server-Side Request Forgery (SSRF) pada nextcloud enterprise server, nextcloud server. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erroneously. It is recommended that the Nextcloud Server is upgraded to 23.0.8 or 24.0.4. It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.10.4, 23.0.8 or 24.0.4. There are no known workarounds for this issue.

Rincian

Terbit di NVD: 16 September 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-918: Server-Side Request Forgery (SSRF)
EPSS (30 hari): 0,96% peluang dieksploitasi; lebih tinggi dari 60,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
nextcloud	nextcloud enterprise server	Semua versi sebelum 22.2.10.4
nextcloud	nextcloud enterprise server	Versi 23.0.0 hingga sebelum 23.0.8
nextcloud	nextcloud enterprise server	Versi 24.0.0 hingga sebelum 24.0.4
nextcloud	nextcloud server	Semua versi sebelum 23.0.8
nextcloud	nextcloud server	Versi 24.0.0 hingga sebelum 24.0.4

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/nextcloud/server/pull/32988 patch · advisory pihak ketiga
https://github.com/nextcloud/server/pull/33031 patch · advisory pihak ketiga
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-rmf9-w497-8cq8 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.