CVE-2024-37314

EUVD-2024-36572
Nextcloud Photos is a photo management app. Users can remove photos from the album of registered users. It is recommended that the Nextcloud Server is upgraded to 25.0.7 or 26.0.2 and the Nextcloud Enterprise Server is upgraded to 25.0.7 or 26.0.2.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.5 LOW
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
GitHub_MCNA
3.5 LOW
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 34%
Affected Products (NVD)
VendorProductVersion
nextcloudnextcloud_server
25.0.0 ≤
𝑥
< 25.0.7
nextcloudnextcloud_server
26.0.0 ≤
𝑥
< 26.0.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/nextcloud/photos/pull/1749
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9chh-5prm-wp43
https://hackerone.com/reports/1946298
https://github.com/nextcloud/photos/pull/1749
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9chh-5prm-wp43
https://hackerone.com/reports/1946298