Lucene search

GitHub_MCVELIST:CVE-2022-29159

HistoryMay 20, 2022 - 3:40 p.m.

CVE-2022-29159 Possibility for anyone to add a stack with existing tasks on anyone's board in Nextcloud Deck

2022-05-2015:40:10

CWE-639

GitHub_M

www.cve.org

nextcloud deck

kanban-style

project management

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

35.3%

JSON

Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud. In versions prior to 1.4.8, 1.5.6, and 1.6.1, an authenticated user can move stacks with cards from their own board to a board of another user. The Nextcloud Deck app contains a patch for this issue in versions 1.4.8, 1.5.6, and 1.6.1. There are no known currently-known workarounds available.

CNA Affected

[
  {
    "product": "security-advisories",
    "vendor": "nextcloud",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.4.8"
      },
      {
        "status": "affected",
        "version": ">= 1.5.0, < 1.5.6"
      },
      {
        "status": "affected",
        "version": "= 1.6.0"
      }
    ]
  }
]

References

github.com/nextcloud/deck/pull/3541

github.com/nextcloud/security-advisories/security/advisories/GHSA-vqhf-673w-7r3j

hackerone.com/reports/1450117

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

35.3%

JSON

Related for CVELIST:CVE-2022-29159