CVE-2022-24888
- Source
- https://cve.org/CVERecord?id=CVE-2022-24888
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24888.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-24888
- Aliases
-
- GHSA-w3h6-p64h-q9jp
- Published
- 2022-04-27T14:25:11Z
- Modified
- 2026-08-12T03:51:11.686930498Z
- Severity
-
- 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
- Summary
- Possible Injection in Nextcloud Server
- Details
-
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1, it is possible to create files and folders that have leading and trailing \n, \r, \t, and \v characters. The server rejects files and folders that have these characters in the middle of their names, so this might be an opportunity for injection. This issue is fixed in versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1. There are currently no known workarounds.
- Database specific
{ "cwe_ids": [ "CWE-74" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24888.json", "cna_assigner": "GitHub_M", "unresolved_ranges": [ { "extracted_events": [ { "fixed": "20.0.14.4" } ], "source": "AFFECTED_FIELD" } ] }- References
-
- https://hackerone.com/reports/1402249
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24888.json
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w3h6-p64h-q9jp
- https://nvd.nist.gov/vuln/detail/CVE-2022-24888
- https://security.gentoo.org/glsa/202208-17
- https://github.com/nextcloud/server/pull/29895
Affected packages
Git / github.com/nextcloud/server
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nextcloud/server
- Events
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "21.0.0" }, { "fixed": "21.0.8" }, { "introduced": "22.0.0" }, { "fixed": "22.2.4" }, { "introduced": "23.0.0" }, { "fixed": "23.0.1" } ], "source": "CPE_RANGE" }
Affected versions
22.*
22.1.0
v21.*
v21.0.0
v21.0.1
v21.0.1RC1
v21.0.2
v21.0.2RC1
v21.0.3
v21.0.3rc1
v21.0.4
v21.0.4rc1
v21.0.5
v21.0.5rc1
v21.0.6
v21.0.6rc1
v21.0.7
v21.0.8rc1
v21.0.8rc2
v21.0.8rc3
v22.*
v22.0.0
v22.1.0
v22.1.0rc1
v22.1.1
v22.1.1rc1
v22.1.1rc2
v22.2.0
v22.2.0rc2
v22.2.1
v22.2.1rc1
v22.2.2
v22.2.3
v22.2.4rc1
v22.2.4rc2
v22.2.4rc3
v23.*
v23.0.0
v23.0.1rc1
v23.0.1rc2
v23.0.1rc3