{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-01T19:20:03.404","vulnerabilities":[{"cve":{"id":"CVE-2022-36074","sourceIdentifier":"security-advisories@github.com","published":"2022-09-15T22:15:11.303","lastModified":"2026-06-17T04:52:51.727","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Nextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fails to strip the Authorization header on HTTP downgrade. This can lead to account access exposure and compromise. It is recommended that the Nextcloud Server is upgraded to 23.0.7 or 24.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.11, 23.0.7 or 24.0.3. There are no known workarounds for this issue."},{"lang":"es","value":"Nextcloud server es un producto de nube personal de código abierto. Las versiones afectadas de este paquete son vulnerables a una Exposición de Información que falla al eliminar el encabezado de autorización en el descenso de HTTP. Esto puede conllevar a una exposición del acceso a la cuenta y su compromiso. Es recomendado actualizar el servidor Nextcloud a versión 23.0.7 o 24.0.3. Es recomendado que Nextcloud Enterprise Server sea actualizado a versión 22.2.11, 23.0.7 o 24.0.3. No se presentan mitigaciones conocidas para este problema"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"nextcloud","product":"security-advisories","versions":[{"version":"< 23.0.7","status":"affected"},{"version":">= 24.0.0, < 24.0.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":5.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-23T15:49:03.994194Z","id":"CVE-2022-36074","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nextcloud:nextcloud_enterprise_server:*:*:*:*:*:*:*:*","versionEndExcluding":"22.2.11","matchCriteriaId":"25E67FEF-5998-4CEF-95CC-7039947F763F"},{"vulnerable":true,"criteria":"cpe:2.3:a:nextcloud:nextcloud_enterprise_server:*:*:*:*:*:*:*:*","versionStartIncluding":"23.0.0","versionEndExcluding":"23.0.7","matchCriteriaId":"83FDE312-401A-48C0-BFA0-F3439571CB40"},{"vulnerable":true,"criteria":"cpe:2.3:a:nextcloud:nextcloud_enterprise_server:*:*:*:*:*:*:*:*","versionStartIncluding":"24.0.0","versionEndExcluding":"24.0.3","matchCriteriaId":"89DC7F6E-DF99-4A47-9038-F225EDA90298"},{"vulnerable":true,"criteria":"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*","versionEndExcluding":"23.0.7","matchCriteriaId":"0B33B876-3E32-47E7-A6F0-E23A09AC2648"},{"vulnerable":true,"criteria":"cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*","versionStartIncluding":"24.0.0","versionEndExcluding":"24.0.3","matchCriteriaId":"498C4D8E-C26E-4D82-BFDB-3CC84C188714"}]}]}],"references":[{"url":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vqgm-f748-g76v","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/nextcloud/server/pull/32941","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vqgm-f748-g76v","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/nextcloud/server/pull/32941","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}}]}