CVEvulnerability

CVE-2024-22401

4.3 MEDIUM Published 2024-01-18 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2024-01-18
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-281

Description

Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users could change the allowed list of apps, allowing them to use apps that were not intended to be used. It is recommended that the Guests app is upgraded to 2.4.1, 2.5.1 or 3.0.1. There are no known workarounds for this vulnerability.

Affected configurations

• nextcloud guests (< 2.4.1) • nextcloud guests 2.5.0 • nextcloud guests 3.0.0

Related

Weakness · CWE (1)

  • CWE-281 Improper Preservation of Permissions weakness

References