Test ID:	1.3.6.1.4.1.25623.1.0.127381
Category:	General
Title:	Nextcloud Server 24.x < 24.0.10, 25.x < 25.0.4 Multiple Vulnerabilities (GHSA-h3c9-cmh8-7qpj, GHSA-ch7f-px7m-hg25, GHSA-5w64-6c42-rgcv, GHSA-7w2p-rp9m-9xp9)
Summary:	Nextcloud Server is prone to multiple vulnerabilities.
Description:	Summary: Nextcloud Server is prone to multiple vulnerabilities. Vulnerability Insight: The following vulnerabilities exist: - CVE-2023-26482: A missing scope validation allow users to create workflows which are designed to be only available for administrators. - CVE-2023-28833: An admin can upload files with a provided file name into the appdata directory. - CVE-2023-28834: A user can get the full data directory path of the Nextcloud server from an API endpoint. - CVE-2023-28835: Insecure randomness for default password in file sharing when password policy app is disabled. Affected Software/OS: Nextcloud Server version 24.x prior to 24.0.10 and version 25.x prior to 25.0.4. Solution: Update to version 24.0.10, 25.0.4 or later. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2023-26482 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h3c9-cmh8-7qpj https://github.com/nextcloud/server/commit/5a06b50b10cc9278bbe68bbf897a0c4aeb0c4e60 Common Vulnerability Exposure (CVE) ID: CVE-2023-28833 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-ch7f-px7m-hg25 https://github.com/nextcloud/server/pull/36095 Common Vulnerability Exposure (CVE) ID: CVE-2023-28834 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5w64-6c42-rgcv https://github.com/nextcloud/server/issues/33883 https://github.com/nextcloud/server/pull/36094 https://hackerone.com/reports/1690510 Common Vulnerability Exposure (CVE) ID: CVE-2023-28835 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7w2p-rp9m-9xp9 https://github.com/nextcloud/server/pull/36093
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.