CVE-2024-37882: Nextcloud Server can reshare read&share only folder with more permissions

High severity · published Jun 14, 2024

CVE-2024-37882

Nextcloud Server can reshare read&share only folder with more permissions

8.1

CVSS

0.5%

EPSS

On KEV

Description

Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4 and that the Nextcloud Enterprise Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.5% · higher than 45% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

security-advisories · nextcloud

>= 26.0.0, < 26.0.13; >= 27.0.0, < 27.1.8; >= 28.0.0, < 28.0.4 · source: vendor

Nextcloud Server · Nextcloud

26.0.0 before 26.0.13; 27.0.0 before 27.1.8; 28.0.0 before 28.0.4; 23.0.0 before 23.0.12.17; 24.0.0 before 24.0.12.13; 25.0.0 before 25.0.13.8; +3 more · source: NVD

Affected product

security-advisories

nextcloud

All security-advisories CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-37882

CVE.org

https://www.cve.org/CVERecord?id=CVE-2024-37882

Vendor Advisory

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jjm3-j9xh-5xmq

Patch

https://github.com/nextcloud/server/pull/44339

Issue Tracking

https://hackerone.com/reports/2289425