Lucene search
NextcloudGHSA-82XX-98XV-4JXVHistoryNov 25, 2022 - 11:32 a.m.
nextcloudcmd incorrectly trusts bad TLS certificates
2022-11-2511:32:05
github.com
16
nextcloudcmd
tls certificates
man-in-the-middle
attack
nextcloud desktop client
upgrade
workaround
hackerone
pullrequest
public ticket
security advisories
support ticket
CVSS3
4.7
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS
0.001
Percentile
20.4%
Description
Impact
Man-in-the-middle attack is possible in case a user can be made running a nextcloudcmd CLI command locally.
Patches
It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1
Workarounds
Don’t execute nextcloudcmd commands
References
For more information
If you have any questions or comments about this advisory:
- Create a post in nextcloud/security-advisories
- Customers: Open a support ticket at support.nextcloud.com
Related
hackerone
hackerone
Nextcloud: nextcloudcmd incorrectly trusts bad TLS certificates
2022-09-14 07:53:20
veracode
veracode
Improper Certificate Validation
2022-12-05 05:27:06
cvelist
cvelist
CVE-2022-39334 nextcloudcmd incorrectly trusts bad TLS certificates
2022-11-25 00:00:00
osv
osv
CVE-2022-39334
2022-11-25 19:15:11
debiancve
debiancve
CVE-2022-39334
2022-11-25 19:15:11
cve
cve
CVE-2022-39334
2022-11-25 19:15:11
ubuntucve
ubuntucve
CVE-2022-39334
2022-11-25 00:00:00
prion
prion
Code injection
2022-11-25 19:15:00
nvd
nvd
CVE-2022-39334
2022-11-25 19:15:11
openvas
openvas
openSUSE: Security Advisory for nextcloud (openSUSE-SU-2023:0171-1)
2024-03-04 00:00:00
openSUSE: Security Advisory for nextcloud (openSUSE-SU-2023:0090-1)
2024-03-04 00:00:00
nessus
nessus
openSUSE 15 Security Update : nextcloud-desktop (openSUSE-SU-2023:0171-1)
2023-07-11 00:00:00
openSUSE 15 Security Update : nextcloud-desktop (openSUSE-SU-2023:0090-1)
2023-04-13 00:00:00
CVSS3
4.7
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS
0.001
Percentile
20.4%
Related for GHSA-82XX-98XV-4JXV