Deck Security Update: Access to Deleted Cards
CVE-2024-37883

4.3MEDIUM

Key Information:

Vendor

Nextcloud
Status
Security-advisories
Vendor
CVE Published:
14 June 2024

What is CVE-2024-37883?

Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A user with access to a deck board was able to access comments and attachments of already deleted cards. It is recommended that the Nextcloud Deck app is upgraded to 1.6.6 or 1.7.5 or 1.8.7 or 1.9.6 or 1.11.3 or 1.12.1.

Affected Version(s)

security-advisories >= 1.6.0, < 1.6.6 < 1.6.0, 1.6.6

security-advisories >= 1.7.0, < 1.7.5 < 1.7.0, 1.7.5

security-advisories >= 1.8.0, < 1.8.7 < 1.8.0, 1.8.7

References

https://github.com/nextcloud/security-advisories/security...
x_refsource_CONFIRM
https://github.com/nextcloud/deck/pull/5423
x_refsource_MISC
https://hackerone.com/reports/2289333
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.