CVE-2024-37314

Nextcloud Photos is a photo management app. Users can remove photos from the album of registered users. It is recommended that the Nextcloud Server is upgraded to 25.0.7 or 26.0.2 and the Nextcloud Enterprise Server is upgraded to 25.0.7 or 26.0.2.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
3.5 LOW
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
GitHub_MCNA
3.5 LOW
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
CISA-ADPADP
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 21%
VendorProductVersion
nextcloudnextcloud_server
25.0.0 ≤
𝑥
< 25.0.7
nextcloudnextcloud_server
26.0.0 ≤
𝑥
< 26.0.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/nextcloud/photos/pull/1749
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9chh-5prm-wp43
https://hackerone.com/reports/1946298
https://github.com/nextcloud/photos/pull/1749
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9chh-5prm-wp43
https://hackerone.com/reports/1946298