CVE-2022-39211

Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erroneously. It is recommended that the Nextcloud Server is upgraded to 23.0.8 or 24.0.4. It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.10.4, 23.0.8 or 24.0.4. There are no known workarounds for this issue.

• CWE-918

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-rmf9-w497-8cq8Third Party Advisory
• https://github.com/nextcloud/server/pull/32988Patch, Third Party Advisory
• https://github.com/nextcloud/server/pull/33031Patch, Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-rmf9-w497-8cq8Third Party Advisory
• https://github.com/nextcloud/server/pull/32988Patch, Third Party Advisory
• https://github.com/nextcloud/server/pull/33031Patch, Third Party Advisory

Published

Sep 16, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39206Onedev is an open source, self-hosted Git Server with CI/CD …9.9
• CVE-2022-39207Onedev is an open source, self-hosted Git Server with CI/CD …5.4
• CVE-2022-39208Onedev is an open source, self-hosted Git Server with CI/CD …7.5
• CVE-2022-39209cmark-gfm is GitHub's fork of cmark, a CommonMark parsing an…6.5
• CVE-2022-3921The Listingo WordPress theme before 3.2.7 does not validate …9.8
• CVE-2022-39210Nextcloud android is the official Android client for the Nex…5.5
• CVE-2022-39212Nextcloud Talk is an open source chat, video & audio calls c…5.3
• CVE-2022-39213go-cvss is a Go module to manipulate Common Vulnerability Sc…7.5
• CVE-2022-39214Combodo iTop is an open source, web-based IT service managem…7.5
• CVE-2022-39215Tauri is a framework for building binaries for all major des…5.8
• CVE-2022-39216Combodo iTop is an open source, web-based IT service managem…9.8
• CVE-2022-39217some-natalie/ghas-to-csv (GitHub Advanced Security to CSV) i…9.8