CVE-2022-24906— Error in deleting deck cards attachment reveals the full application path in Nextcloud Deck
Possible ATT&CK Techniques 1AI
T1122Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-24906
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Error in deleting deck cards attachment reveals the full application path in Nextcloud Deck
Source: CVE Program / CVE List V5
Vulnerability Description
Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud, similar to Trello. The full path of the application is exposed to unauthorized users. It is recommended that the Nextcloud Deck app is upgraded to 1.2.11, 1.4.6, or 1.5.4. There is no workaround available.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Nextcloud信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Nextcloud是德国Nextcloud公司的一套开源的自托管文件同步和共享的通信应用平台。 Nextcloud 存在信息泄露漏洞，该漏洞源于应用程序的完整路径暴露给未经授权的用户。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| nextcloud | security-advisories | < 1.2.11 | - |
II. Public POCs for CVE-2022-24906
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-24906
请登录查看更多情报信息。
Patches & Fixes for CVE-2022-24906 (1)
- https://github.com/nextcloud/deck/pull/3384x_refsource_MISC
Vendor Advisories for CVE-2022-24906 (1)
Other References for CVE-2022-24906 (1)
- https://hackerone.com/reports/1354334x_refsource_MISC
Same Patch Batch · nextcloud · 2022-05-20 · 4 CVEs total
| CVE-2022-29159 | 5.0 MEDIUM | Possibility for anyone to add a stack with existing tasks on anyone's board in Nextcloud D |
| CVE-2022-29163 | 3.5 LOW | Bypass of password requirements when sharing a folder via the Circles app in Nextcloud Ser |
| CVE-2022-29160 | 2.8 LOW | Sensitive files/data exist after deletion of user account in Nextcloud Android |
IV. Related Vulnerabilities
Same product: security-advisories
- CVE-2026-24754
Kiteworks Secure Data Forms Vulnerable to Cross-site Scripti - CVE-2026-45810
Nextcloud: Propfind requests for file comments allowed to lo - CVE-2026-45722
Nextcloud: Tables app allows limited SQLi in ORDER BY with m - CVE-2026-45691
Nextcloud: Bypass of second factor authentication on DAV end - CVE-2026-45690
Nextcloud: Two-Factor Authentication Bypass via Pending Sess
Same vendor: nextcloud
- CVE-2026-45810
Nextcloud: Propfind requests for file comments allowed to lo - CVE-2026-45722
Nextcloud: Tables app allows limited SQLi in ORDER BY with m - CVE-2026-45691
Nextcloud: Bypass of second factor authentication on DAV end - CVE-2026-45690
Nextcloud: Two-Factor Authentication Bypass via Pending Sess - CVE-2026-45545
Nextcloud: SQL Injection in Column Type Parameter Allows Arb
V. Comments for CVE-2022-24906
No comments yet