Nickvergessen

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 29.0.15, 30.0.9, and 31.0.3 Nextcloud Enterprise Server versions prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, and 31.0.3 Description: The issue concerns a bug in session handling. When the server is configured with `remember login cookie lifetime` set to `0`, the second factor confirmation is skipped after a successful login with the username and password, once the session expires on the page to select the second factor and the page is reloaded. Recommendations: For Nextcloud Server versions prior to 29.0.15, 30.0.9, and 31.0.3, update to version 29.0.15, 30.0.9, or 31.0.3. For Nextcloud Enterprise Server versions prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, and 31.0.3, update to version 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, or 31.0.3. As a temporary workaround, set the `remember login cookie lifetime` in config.php to a value other than `0`, e.g. `900`. System administration can delete affected sessions.

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 30.0.2 Nextcloud Server versions prior to 29.0.9 Nextcloud Server versions prior to 28.0.1 Nextcloud Enterprise Server versions prior to 30.0.2 Nextcloud Enterprise Server versions prior to 29.0.9 Nextcloud Groupfolders app versions prior to 18.0.3 Nextcloud Groupfolders app versions prior to 17.0.5 Nextcloud Groupfolders app versions prior to 16.0.11 Description: The issue concerns the absence of quota checking on attachments in Nextcloud Server and Nextcloud Groupfolders app, allowing logged-in users to upload files exceeding the group folder quota. Recommendations: For Nextcloud Server version prior to 30.0.2, update to version 30.0.2 or later. For Nextcloud Server version prior to 29.0.9, update to version 29.0.9 or later. For Nextcloud Server version prior to 28.0.1, update to version 28.0.1 or later. For Nextcloud Enterprise Server version prior to 30.0.2, update to version 30.0.2 or later. For Nextcloud Enterprise Server version prior to 29.0.9, update to version 29.0.9 or later. For Nextcloud Groupfolders app version prior to 18.0.3, update to version 18.0.3 or later. For Nextcloud Groupfolders app version prior to 17.0.5, update to version 17.0.5 or later. For Nextcloud Groupfolders app version prior to 16.0.11, update to version 16.0.11 or later.

Name of the Vulnerable Software and Affected Versions: Nextcloud Desktop versions prior to 3.15 Description: The issue affects Nextcloud Desktop, allowing 3rd party applications to create link shares for almost all data via the socket API. These shares can then be sent to an external service. Recommendations: For versions prior to 3.15, update to version 3.15 to resolve the issue. As a temporary workaround, consider restricting access to the socket API until the update is applied.

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 28.0.13 Nextcloud Server versions prior to 29.0.10 Nextcloud Server versions prior to 30.0.3 Nextcloud Enterprise Server versions prior to 28.0.13 Nextcloud Enterprise Server versions prior to 29.0.10 Nextcloud Enterprise Server versions prior to 30.0.3 Description: Nextcloud Server is a self-hosted personal cloud system. A currently unused endpoint to verify a share recipient was not protected correctly, allowing proxy requests to another server. No known workarounds are available. Recommendations: For Nextcloud Server versions prior to 28.0.13, update to version 28.0.13 or later. For Nextcloud Server versions prior to 29.0.10, update to version 29.0.10 or later. For Nextcloud Server versions prior to 30.0.3, update to version 30.0.3 or later. For Nextcloud Enterprise Server versions prior to 28.0.13, update to version 28.0.13 or later. For Nextcloud Enterprise Server versions prior to 29.0.10, update to version 29.0.10 or later. For Nextcloud Enterprise Server versions prior to 30.0.3, update to version 30.0.3 or later.

In the Nextcloud Desktop Client on Linux, synchronized files between the server and client may become world writable or world readable. This issue is fixed in version 3.13.4.

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 22.2.11 Nextcloud Server versions prior to 23.0.11 Nextcloud Server versions prior to 24.0.6 Nextcloud Enterprise Server versions prior to 22.2.11 Nextcloud Enterprise Server versions prior to 23.0.11 Nextcloud Enterprise Server versions prior to 24.0.6 Description: The issue is related to insecure management of privileges in Nextcloud Server and Nextcloud Enterprise Server. This can allow a remote attacker to disclose protected information. When a server is configured to only allow sharing with users that are in one's own groups, after a user was removed from a group, previously shared items were not unshared. Recommendations: For Nextcloud Server versions prior to 22.2.11, upgrade to version 22.2.11 or later. For Nextcloud Server versions prior to 23.0.11, upgrade to version 23.0.11 or later. For Nextcloud Server versions prior to 24.0.6, upgrade to version 24.0.6 or later. For Nextcloud Enterprise Server versions prior to 22.2.11, upgrade to version 22.2.11 or later. For Nextcloud Enterprise Server versions prior to 23.0.11, upgrade to version 23.0.11 or later. For Nextcloud Enterprise Server versions prior to 24.0.6, upgrade to version 24.0.6 or later.

The Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions, users can download "view-only" files by zipping the complete folder.

The issue is related to the use of Memcached as `memcache.distributed` in Nextcloud, which can cause the rate limiting on the server to be reset unexpectedly, leading to the rate count being reset earlier than intended. This can be exploited by a remote attacker to cause a denial of service.

The issue concerns the brute force protection of public talk conversation passwords in Nextcloud Talk, a chat module for the Nextcloud server platform. In affected versions, this protection can be bypassed due to an endpoint validating the conversation password without registering brute force attempts.

The issue is related to the way PHP's XML functions rely on libxml global state to track configuration variables. This state can be changed by other modules, such as ImageMagick, within the same process, potentially leading to the disclosure of local files accessible to PHP. The vulnerable state may persist across many requests until the process is shut down.

A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevented a correct destruction of the session on logout if cookies were not cleared manually. After successfully authenticating with any other account, the previous session would be continued and the attacker would be authenticated as the previously logged in user. This issue is related to incorrect session expiration.

The user oidc app, an OpenID Connect user backend for Nextcloud, has an issue where authentication can be broken or bypassed.

The Nextcloud Android app has a security issue that allows an attacker with access to an unlocked physical device to bypass the Pin/passcode protection using a third-party app. This enables the attacker to view meta information such as sharer, sharees, and activity of files.

The issue is related to a missing scope validation in the Nextcloud server, allowing users to create workflows designed for administrators only. Some workflows can lead to remote code execution (RCE) by invoking scripts, generating PDFs, or running scripts on the server. The combination of available apps can result in RCE.

The issue is related to the generated fallback password when creating a share in Nextcloud Server, which uses a weak complexity random number generator. This makes the password guessable to an attacker willing to brute force it, especially when the sharer does not change the password. The vulnerability can be exploited by a remote attacker to gain unauthorized access to protected information. It only affects users who do not have a password policy enabled.

The issue is related to the lack of authentication attempt limits in Nextcloud Server, allowing a malicious user to try to reset another user's password and then brute force the password reset token. Although brute forcing the 62^21 combinations for the password reset token would require significant compute resources, it is still a potential risk. There are no known real-world incidents or estimated numbers of affected devices mentioned.

The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. It is missing sanitisation on qml labels used for basic HTML elements such as `strong`, `em`, and `head` lines in the UI of the desktop client. The lack of sanitisation may allow for javascript injection.

The issue is related to an inefficient fetch operation that may impact server performance and/or lead to a denial of service. This can be exploited by a remote attacker to initiate a denial of service attack. The vulnerability is associated with uncontrolled resource consumption.

The issue concerns the `OCFilesNodeFolder::getFullPath()` function, which was validating and normalizing strings in the wrong order. This function is used in the `newFile()` and `newFolder()` items, potentially allowing the creation of paths outside of one's own space and overwriting data from other users with crafted paths.

Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A database error can be generated, potentially causing a denial of service when performed multiple times.