CVE-2024-22404 - OpenCVE

Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to upgrade should disable the file zip app.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Nextcloud	Zipper

Configuration 1 [-]

OR	cpe:2.3:a:nextcloud:zipper::::::::
	cpe:2.3:a:nextcloud:zipper:1.4.0:::::::*

No data.

References

Link	Providers
https://github.com/nextcloud/files_zip/commit/43204539d517a13e945b90652718e2a213f46820
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vhj3-mch4-67fq
https://hackerone.com/reports/2247457

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-01-18T20:14:27.914Z

Updated: 2024-08-01T22:43:34.833Z

Reserved: 2024-01-10T15:09:55.548Z

Link: CVE-2024-22404

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2024-01-18T21:15:08.830

Modified: 2024-01-26T14:37:23.880

Link: CVE-2024-22404

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-22404", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-01-10T15:09:55.548Z", "datePublished": "2024-01-18T20:14:27.914Z", "dateUpdated": "2024-08-01T22:43:34.833Z"}, "containers": {"cna": {"title": "Permissions bypass in Nextcloud with the files zip app", "problemTypes": [{"descriptions": [{"cweId": "CWE-281", "lang": "en", "description": "CWE-281: Improper Preservation of Permissions", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vhj3-mch4-67fq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vhj3-mch4-67fq"}, {"name": "https://github.com/nextcloud/files_zip/commit/43204539d517a13e945b90652718e2a213f46820", "tags": ["x_refsource_MISC"], "url": "https://github.com/nextcloud/files_zip/commit/43204539d517a13e945b90652718e2a213f46820"}, {"name": "https://hackerone.com/reports/2247457", "tags": ["x_refsource_MISC"], "url": "https://hackerone.com/reports/2247457"}], "affected": [{"vendor": "nextcloud", "product": "security-advisories", "versions": [{"version": ">= 1.2.0, < 1.2.1", "status": "affected"}, {"version": ">= 1.3.0, < 1.4.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-01-18T20:14:27.914Z"}, "descriptions": [{"lang": "en", "value": "Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download \"view-only\" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to upgrade should disable the file zip app."}], "source": {"advisory": "GHSA-vhj3-mch4-67fq", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:43:34.833Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vhj3-mch4-67fq", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vhj3-mch4-67fq"}, {"name": "https://github.com/nextcloud/files_zip/commit/43204539d517a13e945b90652718e2a213f46820", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/nextcloud/files_zip/commit/43204539d517a13e945b90652718e2a213f46820"}, {"name": "https://hackerone.com/reports/2247457", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://hackerone.com/reports/2247457"}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nextcloud:zipper:*:*:*:*:*:*:*:*", "matchCriteriaId": "2CACAF88-8B0B-4909-B633-02EE818C3F8C", "versionEndExcluding": "1.2.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:nextcloud:zipper:1.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "AEFDD9DF-54EB-47B4-A70D-D3910C77F2B0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download \"view-only\" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to upgrade should disable the file zip app."}, {"lang": "es", "value": "La aplicaci\u00f3n Nextcloud files Zip es una herramienta para crear archivos zip a partir de uno o varios archivos desde Nextcloud. En las versiones afectadas, los usuarios pueden descargar archivos de \"s\u00f3lo lectura\" comprimiendo la carpeta completa. Se recomienda actualizar la aplicaci\u00f3n Archivos ZIP a 1.2.1, 1.4.1 o 1.5.0. Los usuarios que no puedan actualizar deben desactivar la aplicaci\u00f3n de archivos zip."}], "id": "CVE-2024-22404", "lastModified": "2024-01-26T14:37:23.880", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-01-18T21:15:08.830", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/nextcloud/files_zip/commit/43204539d517a13e945b90652718e2a213f46820"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vhj3-mch4-67fq"}, {"source": "security-advisories@github.com", "tags": ["Permissions Required", "Third Party Advisory"], "url": "https://hackerone.com/reports/2247457"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-281"}], "source": "security-advisories@github.com", "type": "Primary"}]}