Nextcloud Server Update Recommended to Prevent File Deletion
CVE-2024-37884

5.4MEDIUM

Key Information:

Vendor

Nextcloud
Status
Security-advisories
Vendor
CVE Published:
14 June 2024

What is CVE-2024-37884?

Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with read permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3.

Affected Version(s)

security-advisories >= 26.0.0, < 26.0.13 < 26.0.0, 26.0.13

security-advisories >= 27.0.0, < 27.1.8 < 27.0.0, 27.1.8

security-advisories >= 28.0.0, < 28.0.4 < 28.0.0, 28.0.4

References

https://github.com/nextcloud/security-advisories/security...
x_refsource_CONFIRM
https://github.com/nextcloud/server/pull/43727
x_refsource_MISC
https://hackerone.com/reports/2290680
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.