地图 / Improper handling of request URLs in nextcloud/guests allows guest users to bypass app allowlist

Improper handling of request URLs in nextcloud/guests allows guest users to bypass app allowlist

其他弱点 / Improper Handling of URL Encoding (Hex Encoding) / #2251074

厂商: Nextcloud
严重程度: 低危 · CVSS 5.4
赏金: —
弱点: Improper Handling of URL Encoding (Hex Encoding)
研究员: @ryotak
披露日期: 2024-01-18
资产: nextcloud/guests
CVE: CVE-2024-22402

该报告还没有中文解读。

时间线

2023-11-14报告提交
2024-01-18公开披露

阅读 HackerOne 原文 ↗作者 @ryotak · 版权归作者与 Nextcloud 所有

同类报告

HTML injection in support.razer.com [IE only]Razer · — · $250 Cache PoisoningInternet Bug Bounty · 2021-08-26 Encoded slash traversal in the IPFS/IPNS URL rewrite escapes the configured gateway namespacecurl · 2026-09-14 Incorrect IPv6 literal parsing leads to validated connection to unexpected https server.curl · 2021-01-12