Cyber Resilience

CVE-2024-22402

Medium

Published: 18 January 2024

Published
18 January 2024
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.0032 55.3th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-22402 is a medium-severity Improper Preservation of Permissions (CWE-281) vulnerability in Nextcloud Guests. Its CVSS base score is 5.4 (Medium).

Operationally, ranked in the top 44.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page of apps they were actually not allowed to access. Depending on…

more

the selection of apps installed this may present a permissions bypass. It is recommended that the Guests app is upgraded to 2.4.1, 2.5.1 or 3.0.1. There are no known workarounds for this vulnerability.

CWE(s)
CWE-281

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

nextcloud
guests
2.5.0, 3.0.0 · ≤ 2.4.1

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

PS-5 Personnel Transfer
addresses: CWE-281

Forces removal or modification of permissions no longer required after reassignment, preventing improper preservation of old access rights.

References