Cyber Resilience

CVE-2024-22404

Medium

Published: 18 January 2024

Published
18 January 2024
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
EPSS Score 0.0067 72.0th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-22404 is a medium-severity Improper Preservation of Permissions (CWE-281) vulnerability in Nextcloud Zipper. Its CVSS base score is 4.1 (Medium).

Operationally, ranked in the top 28.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only" files by zipping the complete folder. It is recommended that the Files ZIP app…

more

is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to upgrade should disable the file zip app.

CWE(s)
CWE-281

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

nextcloud
zipper
1.4.0 · ≤ 1.2.1

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

PS-5 Personnel Transfer
addresses: CWE-281

Forces removal or modification of permissions no longer required after reassignment, preventing improper preservation of old access rights.

References