CVE-2024-22400

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-22400
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-22400.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-22400
Aliases
  • GHSA-622q-xhfr-xmv7
Published
2024-01-18T19:21:06.618Z
Modified
2025-12-05T03:12:51.488280Z
Severity
  • 3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Open redirect in user_saml via RelayState parameter in Nextcloud User Saml
Details

Nextcloud User Saml is an app for authenticating Nextcloud users using SAML. In affected versions users can be given a link to the Nextcloud server and end up on a uncontrolled thirdparty server. It is recommended that the User Saml app is upgraded to version 5.1.5, 5.2.5, or 6.0.1. There are no known workarounds for this issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-601"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22400.json"
}
References

Affected packages

Git / github.com/nextcloud/user_saml

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/user_saml
Events
Introduced
3ae2107e258cc6005ab125a67b27d338dc4b6a57
Fixed
50396c39aba1c34373512f0e2fa66e0e55e15e8d
Database specific 
{
    "versions": [
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.1.5"
        }
    ]
}
Type
GIT
Repo
https://github.com/nextcloud/user_saml
Events
Introduced
109ef789efbc774d5f7301cd5b91f230238dd6f8
Fixed
75378ad5a98dc886533854a941e1c9a293aee711
Database specific 
{
    "versions": [
        {
            "introduced": "5.2.0"
        },
        {
            "fixed": "5.2.5"
        }
    ]
}
Type
GIT
Repo
https://github.com/nextcloud/user_saml
Events
Introduced
e7e1cbd43e3a2b6eb463fa27c2a8ce96ef9035a1
Fixed
e96be0fab94d00829ed5e3136bdfc84960c4056e
Database specific 
{
    "versions": [
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.0.1"
        }
    ]
}

Affected versions

v5.*

v5.0.0
v5.0.1
v5.0.2
v5.0.3
v5.1.0
v5.1.1
v5.1.2
v5.1.3
v5.1.4
v5.2.0
v5.2.1
v5.2.2
v5.2.3
v5.2.4

v6.*

v6.0.0