« Volver al listado

CVE-2024-22400

Estado: ModificadaMedia (6.1)—

Nextcloud User Saml is an app for authenticating Nextcloud users using SAML. In affected versions users can be given a link to the Nextcloud server and end up on a uncontrolled thirdparty server. It is recommended that the User Saml app is upgraded to version 5.1.5, 5.2.5, or 6.0.1. There are no known workarounds for this issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Nextcloud — SSO & Saml Authentication

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-22400",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-22400",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-01-19T14:55:15.652689Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.1,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.6
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "nextcloud",
          "product": "security-advisories",
          "versions": [
            {
              "status": "affected",
              "version": ">= 5.0.0, < 5.1.5"
            },
            {
              "status": "affected",
              "version": ">= 5.2.0, < 5.2.5"
            },
            {
              "status": "affected",
              "version": ">= 6.0.0, < 6.0.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-01-18T20:15:08.360",
  "references": [
    {
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-622q-xhfr-xmv7",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nextcloud/user_saml/commit/b184304a476deeba36e92b70562d5de7c2f85f8a",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nextcloud/user_saml/pull/788",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://hackerone.com/reports/2263044",
      "tags": [
        "Permissions Required",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-622q-xhfr-xmv7",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/nextcloud/user_saml/commit/b184304a476deeba36e92b70562d5de7c2f85f8a",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/nextcloud/user_saml/pull/788",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://hackerone.com/reports/2263044",
      "tags": [
        "Permissions Required",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nextcloud User Saml is an app for authenticating Nextcloud users using SAML. In affected versions users can be given a link to the Nextcloud server and end up on a uncontrolled thirdparty server. It is recommended that the User Saml app is upgraded to version 5.1.5, 5.2.5, or 6.0.1. There are no known workarounds for this issue."
    },
    {
      "lang": "es",
      "value": "Nextcloud User Saml es una aplicación para autenticar a los usuarios de Nextcloud mediante SAML. En las versiones afectadas, a los usuarios se les puede proporcionar un enlace al servidor de Nextcloud y terminar en un servidor de terceros no controlado. Se recomienda actualizar la aplicación User Saml a la versión 5.1.5, 5.2.5 o 6.0.1. No se conocen workarounds para este problema."
    }
  ],
  "lastModified": "2026-06-17T07:11:20.173",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nextcloud:sso_\\&_saml_authentication:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68724AAA-D837-4365-88F2-835D518A1805",
              "versionEndExcluding": "5.1.5",
              "versionStartIncluding": "5.0.0"
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:sso_\\&_saml_authentication:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F52CDDE-DE98-4150-B3A1-1FB15C6A0F19",
              "versionEndExcluding": "5.2.5",
              "versionStartIncluding": "5.2.0"
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:sso_\\&_saml_authentication:6.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85B7A2B1-195F-4C8C-8521-E6C140A79B7A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}