CVE-2022-39334 | BDVDB-2026-189362 Detail

Description#

Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS certificates, which may enable a Man-in-the-middle attack that exposes sensitive data or credentials to a network attacker. This affects the CLI only. It does not affect the standard GUI desktop Nextcloud clients, and it does not affect the Nextcloud server.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12022-11-25Record published in the CVE List.
2. Version 22025-11-03Most recent update recorded in the CVE List.