CVE-2024-37884

EUVD-2024-36868
Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with read permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.5 LOW
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
GitHub_MCNA
3.5 LOW
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 36%
Affected Products (NVD)
VendorProductVersion
nextcloudnextcloud_server
25.0.0 ≤
𝑥
< 25.0.13.7
nextcloudnextcloud_server
26.0.0 ≤
𝑥
< 26.0.13
nextcloudnextcloud_server
26.0.0 ≤
𝑥
< 26.0.13
nextcloudnextcloud_server
27.0.0 ≤
𝑥
< 27.1.8
nextcloudnextcloud_server
27.0.0 ≤
𝑥
< 27.1.8
nextcloudnextcloud_server
28.0.0 ≤
𝑥
< 28.0.4
nextcloudnextcloud_server
28.0.0 ≤
𝑥
< 28.0.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xwgx-f37p-xh8c
https://github.com/nextcloud/server/pull/43727
https://hackerone.com/reports/2290680
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xwgx-f37p-xh8c
https://github.com/nextcloud/server/pull/43727
https://hackerone.com/reports/2290680