CVE-2022-39334

 

Published at: - 25-11-2022 08:15

Last modified: - 25-11-2022 09:15

Total changes: - 1

Description

Nextcloud desktop is the desktop sync client for Nextcloud. Versions prior to 3.6.1 would incorrectly trust invalid TLS certificates. A Man-in-the-middle attack is possible in case a user can be made running a nextcloudcmd CLI command locally. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this vulnerability.

Common Vulnerability Scoring System (CVSS)

-

 

Verification logic

 

Reference

• https://hackerone.com/reports/1699740
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-82xx-98xv-4jxv
• https://github.com/nextcloud/desktop/pull/5022
• https://github.com/nextcloud/desktop/issues/4927

 

Keywords

NVD

 

CVE-2022-39334

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures