CVE-2024-37884: Nextcloud Server's users can delete old versions of read-only shared files

Medium severity · published Jun 14, 2024

CVE-2024-37884

Nextcloud Server's users can delete old versions of read-only shared files

5.4

CVSS

0.4%

EPSS

On KEV

Description

Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with read permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

None

Integrity

Low

Availability

Low

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 31% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

security-advisories · nextcloud

>= 26.0.0, < 26.0.13; >= 27.0.0, < 27.1.8; >= 28.0.0, < 28.0.4 · source: vendor

Nextcloud Server · Nextcloud

25.0.0 before 25.0.13.7; 26.0.0 before 26.0.13; 26.0.0 before 26.0.13; 27.0.0 before 27.1.8; 27.0.0 before 27.1.8; 28.0.0 before 28.0.4; +1 more · source: NVD

Affected product

security-advisories

nextcloud

All security-advisories CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-37884

CVE.org

https://www.cve.org/CVERecord?id=CVE-2024-37884

Vendor Advisory

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xwgx-f37p-xh8c

Patch

https://github.com/nextcloud/server/pull/43727

Issue Tracking

https://hackerone.com/reports/2290680