CVE-2022-24888: Possible Injection in Nextcloud Server
First published: Wed Apr 27 2022(Updated: )
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1, it is possible to create files and folders that have leading and trailing \n, \r, \t, and \v characters. The server rejects files and folders that have these characters in the middle of their names, so this might be an opportunity for injection. This issue is fixed in versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1. There are currently no known workarounds.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nextcloud Nextcloud Server | <20.0.14.4 | |
| Nextcloud Nextcloud Server | >=21.0.0<21.0.8 | |
| Nextcloud Nextcloud Server | >=22.0.0<22.2.4 | |
| Nextcloud Nextcloud Server | >=23.0.0<23.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-24888?
CVE-2022-24888 is a vulnerability in Nextcloud Server that allows the creation of files and folders with leading and trailing special characters, which are normally rejected by the server.
How does CVE-2022-24888 impact Nextcloud Server?
CVE-2022-24888 allows an attacker to create files and folders with special characters that can potentially bypass server restrictions.
What are the affected versions of Nextcloud Server?
Nextcloud Server versions 20.0.14.4, 21.0.0 to 21.0.8, 22.0.0 to 22.2.4, and 23.0.0 to 23.0.1 are affected by CVE-2022-24888.
What is the severity of CVE-2022-24888?
CVE-2022-24888 has a severity rating of 4.3, classified as medium.
How can I fix CVE-2022-24888?
To fix CVE-2022-24888, it is recommended to update Nextcloud Server to versions 20.0.14.5, 21.0.9, 22.2.5, or 23.0.2 or later, as they contain the necessary patches to address the vulnerability.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/remedy
- agent/title
- agent/author
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- vendor/nextcloud
- canonical/nextcloud nextcloud server
- version/nextcloud nextcloud server/21.0.0
- version/nextcloud nextcloud server/22.0.0
- version/nextcloud nextcloud server/23.0.0