CVE-2025-47792

Katalog CVE

CVSS 6.1 · Medium EPSS 0,18%

Kerentanan Improper Access Control pada nextcloud desktop. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Nextcloud Desktop is the desktop sync client for Nextcloud. In versions of Nextcloud Desktop prior to 3.15, 3rdparty applications already installed on a user machine can create link shares for almost all data via the socket API. These shares can then be easily sent off to an external service. Nextcloud Desktop fixes the issue in version 3.15. No known workarounds are available.

Rincian

Terbit di NVD

16 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-862: Missing Authorization

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 7,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nextcloud/desktop/pull/7517 patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qm2f-959g-7p65 advisory pihak ketiga
• https://hackerone.com/reports/1995856 permissions required