4.3
CVE-2022-24906
- EPSS 1.01%
- Veröffentlicht 20.05.2022 16:15:09
- Zuletzt bearbeitet 21.11.2024 06:51:22
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
LoginError in deleting deck cards attachment reveals the full application path in Nextcloud Deck
Error in deleting deck cards attachment reveals the full application path
Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud, similar to Trello. The full path of the application is exposed to unauthorized users. It is recommended that the Nextcloud Deck app is upgraded to 1.2.11, 1.4.6, or 1.5.4. There is no workaround available.
Mögliche Gegenmaßnahme
Deck: No workaround available
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Weitere Schwachstelleninformationen
SystemNextcloud App
≫
Produkt
Deck
Version
>= 0.0.0, < 1.2.11
Version
>= 1.4.0, < 1.4.6
Version
>= 1.5.0, < 1.5.4
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.01% | 0.587 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
|
| nvd@nist.gov | 4 | 8 | 2.9 |
AV:N/AC:L/Au:S/C:P/I:N/A:N
|
| security-advisories@github.com | 3.5 | 2.1 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
|
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-209 Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
https://github.com/nextcloud/deck/pull/3384
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hx9w-xfrg-2qvp
https://hackerone.com/reports/1354334
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hx9w-xfrg-2qvp