CVE-2022-24906: Error in deleting deck cards attachment reveals the full application path in Nextcloud Deck
Published May 20, 2022
·Updated
Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud, similar to Trello. The full path of the application is exposed to unauthorized users. It is recommended that the Nextcloud Deck app is upgraded to 1.2.11, 1.4.6, or 1.5.4. There is no workaround available.
Affected Software
2 affected components
Nextcloud Deck<1.2.11
Nextcloud Deck>=1.4.0<1.4.6
Remediation
Patch Available
Event History
May 20, 2022
CVE Published
via MITRE·03:40 PM
Data Sourced
via MITRE·03:40 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2022-24906?
CVE-2022-24906 is a vulnerability affecting Nextcloud Deck, a Kanban-style project and personal management tool for Nextcloud.
2
How does the CVE-2022-24906 vulnerability affect Nextcloud Deck?
The vulnerability exposes the full path of the application to unauthorized users.
3
What is the severity of CVE-2022-24906?
The severity of CVE-2022-24906 is medium with a CVSS score of 4.3.
4
How can I fix the CVE-2022-24906 vulnerability in Nextcloud Deck?
To fix the vulnerability, it is recommended to upgrade Nextcloud Deck app to version 1.2.11, 1.4.6, or 1.5.4.
5
Are there any workarounds available for CVE-2022-24906?
No, there are no workarounds available for CVE-2022-24906.