CVE-2024-22404CWE-281

Permissions bypass in Nextcloud with the files zip app

Medium · published January 18, 2024

CVSS v3.1
4.1
EPSS
1%
Percentile
43.1
In the wild
Unconfirmed
What it is

Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to upgrade should disable the file zip app.

The record
Technical detail
CVSS v3.1
4.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00517 · 43.1th percentile
Weakness
CWE-281 · Improper Preservation of Permissions
Published
2024-01-18T20:14Z
EPSS history
Timeline
  • 18 JAN 20:14Z
    Permissions bypass in Nextcloud with the files zip app
    cvelistv5