CVE-2022-41970CWE-284CWE-863

Nextcloud Server's disabled download shares still allow download through preview images

Low · published December 1, 2022

CVSS v3.1
2.6
EPSS
1%
Percentile
50.5
In the wild
Unconfirmed
What it is

Nextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disabled download shares still allow download through preview images. Images could be downloaded and previews of documents (first page) can be downloaded without being watermarked. Versions 24.0.7 and 25.0.1 contain a fix for this issue. No known workarounds are available.

The record
Technical detail
CVSS v3.1
2.6 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00649 · 50.5th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-863 · Incorrect Authorization
Published
2022-12-01T20:54Z
EPSS history
Timeline
  • 01 DEC 20:54Z
    Nextcloud Server's disabled download shares still allow download through preview images
    cvelistv5