Vulnerability in Nextcloud Security-Advisories
CVE-2024-22404
Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to upgrade should disable the file zip app.
EPSS: 0.005 (41.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N.
Affected products
- Nextcloud Security-advisories — versions >= 1.2.0, < 1.2.1, >= 1.3.0, < 1.4.1
- Nextcloud Zipper — versions 1.4.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Permissions Required, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-22404?
- CVE-2024-22404 is a medium-severity vulnerability in Nextcloud Security-Advisories, classified under Improper Preservation of Permissions. CVSS score: 4.1/10. Published 2024-01-18.
- How severe is CVE-2024-22404?
- Medium severity. CVSS v3 base score is 4.1 out of 10.
- Is CVE-2024-22404 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.