Nextcloud Server <=24.0.3 Authorization Header Info Exposure
CVE-2022-36074 Published on September 15, 2022
Authentication headers exposed on by Nextcloud Server
Nextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fails to strip the Authorization header on HTTP downgrade. This can lead to account access exposure and compromise. It is recommended that the Nextcloud Server is upgraded to 23.0.7 or 24.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.11, 23.0.7 or 24.0.3. There are no known workarounds for this issue.
Vulnerability Analysis
CVE-2022-36074 is exploitable with network access, requires user interaction and a small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is an Information Disclosure Vulnerability?
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVE-2022-36074 has been classified to as an Information Disclosure vulnerability or weakness.
Products Associated with CVE-2022-36074
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2022-36074 are published in these products:
Affected Versions
nextcloud security-advisories:- Version < 23.0.7 is affected.
- Version >= 24.0.0, < 24.0.3 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.