CVE-2022-36074CWE-200

Authentication headers exposed on by Nextcloud Server

Medium · published September 15, 2022

CVSS v3.1
6.4
EPSS
1%
Percentile
54.7
In the wild
Unconfirmed
What it is

Nextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fails to strip the Authorization header on HTTP downgrade. This can lead to account access exposure and compromise. It is recommended that the Nextcloud Server is upgraded to 23.0.7 or 24.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.11, 23.0.7 or 24.0.3. There are no known workarounds for this issue.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00756 · 54.7th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2022-09-15T22:00Z
EPSS history
Timeline
  • 15 SEP 22:00Z
    Authentication headers exposed on by Nextcloud Server
    cvelistv5