Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-22404

Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to upgrade should disable the file zip app.

Published

2024-01-18T21:15:08.830

Last Modified

2024-11-21T08:56:12.947

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 4.1 (MEDIUM)

Weaknesses

Type: Primary
CWE-281

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	nextcloud	zipper	< 1.2.1	Yes
Application	nextcloud	zipper	1.4.0	Yes

References

https://github.com/nextcloud/files_zip/commit/43204539d517a13e945b90652718e2a213f46820 Patch ([email protected])
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vhj3-mch4-67fq Vendor Advisory ([email protected])
https://hackerone.com/reports/2247457 Permissions Required, Third Party Advisory ([email protected])
https://github.com/nextcloud/files_zip/commit/43204539d517a13e945b90652718e2a213f46820 Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vhj3-mch4-67fq Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://hackerone.com/reports/2247457 Permissions Required, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)