CVE-2024-22403

Katalog CVE

CVSS 3.7 · Low EPSS 0,45%

Kerentanan Insufficient Session Expiration pada nextcloud server. Skor CVSS 3.1 3.7 (Low) menurut NVD.

Deskripsi (NVD)

Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any time using the code. As of version 28.0.0 OAuth codes are invalidated after 10 minutes and will no longer be authenticated. To exploit this vulnerability an attacker would need to intercept an OAuth code from a user session. It is recommended that the Nextcloud Server is upgraded to 28.0.0. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD

18 Januari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

3.7 (Low), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-613: Insufficient Session Expiration

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wppc-f5g8-vx36 advisory vendor
• https://github.com/nextcloud/server/pull/40766 patch · advisory vendor
• https://hackerone.com/reports/1784162 permissions required · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S6PN4GVJ5TZUC6W...