CVE-2022-24889

    Dashboard / Vulnerabilities / CVE-2022-24889

    CVE-2022-24889

    Published: 27 Apr 2022Last Modified: 12 Aug 2026

    Summary: Insufficient Verification of Data Authenticity in Nextcloud Server

    Details: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 21.0.8, 22.2.4, and 23.0.1, it is possible to trick administrators into enabling "recommended" apps for the Nextcloud server that they do not need, thus expanding their attack surface unnecessarily. This issue is fixed in versions 21.0.8 , 22.2.4, and 23.0.1.

    References: https://hackerone.com/reports/1403614, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24889.json, https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5vw6-6prg-gvw6, https://nvd.nist.gov/vuln/detail/CVE-2022-24889, https://security.gentoo.org/glsa/202208-17, https://github.com/nextcloud/server/pull/30615

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -2721bbb5da8a9abb9a8ee610181315ad9b6b8ba8

    Affected versions

    v21.0.8rc3
    v21.0.8rc2
    v21.0.8rc1
    v21.0.7
    v21.0.6
    v21.0.6rc1
    v21.0.5
    v21.0.5rc1
    v21.0.4
    v21.0.4rc1
    v21.0.3
    v21.0.3rc1
    v21.0.2
    v21.0.2RC1
    v21.0.1
    v21.0.1RC1
    v21.0.0
    v21.0.0RC2
    v21.0.0RC1
    v21.0.0beta8
    v21.0.0beta7
    v21.0.0beta6
    v21.0.0beta5
    v21.0.0beta4
    v21.0.0beta3
    v21.0.0beta2
    v21.0.0beta1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-24889 | CVE-DB