title: Server-Side Request Forgery (SSRF) via potential filter bypass in Nextcloud Server
description: Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erroneously. It is recommended that the Nextcloud Server is upgraded to 23.0.8 or 24.0.4. It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.10.4, 23.0.8 or 24.0.4. There are no known workarounds for this issue.
problem types: CWE-918: Server-Side Request Forgery (SSRF)
affected:
{
product: security-advisories
vendor: nextcloud
versions:
status: affected, version: < 23.0.8
status: affected, version: >= 24.0.0, < 24.0.4
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N
version: 3.1
]