VulnerabilityModified
CVE-2024-37884
A malicious user was able to send delete requests for old versions of files they only got shared with read permissions.
MEDIUM 5.4EPSS 0.37%
Does this matter?
Lower severity and a low EPSS score (0.37%). Track it; it rarely justifies an emergency change on its own.
Description
Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with read permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- EPSS
- 0.37% probability · 31th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-284
- Affected
- nextcloud/nextcloud server
- Source
- security-advisories@github.com
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xwgx-f37p-xh8cVendor Advisory
- https://github.com/nextcloud/server/pull/43727Patch
- https://hackerone.com/reports/2290680Issue Tracking
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xwgx-f37p-xh8cVendor Advisory
- https://github.com/nextcloud/server/pull/43727Patch
- https://hackerone.com/reports/2290680Issue Tracking
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.