CVE-2024-37317CWE-284

Nextcloud Notes app can be tricked into using a received share created before the user logged in

Medium · published June 14, 2024

CVSS v3.1
4.6
EPSS
0%
Percentile
22.9
In the wild
Unconfirmed
What it is

The Nextcloud Notes app is a distraction free notes taking app for Nextcloud. If an attacker managed to share a folder called `Notes/` with a newly created user before they logged in, the Notes app would use that folder store the personal notes. It is recommended that the Nextcloud Notes app is upgraded to 4.9.3.

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00312 · 22.9th percentile
Weakness
CWE-284 · Improper Access Control
Published
2024-06-14T15:25Z
EPSS history
Timeline
  • 14 JUN 15:25Z
    Nextcloud Notes app can be tricked into using a received share created before the user logged in
    cvelistv5