CVE-2024-37884CWE-284

Nextcloud Server's users can delete old versions of read-only shared files

Low · published June 14, 2024

CVSS v3.1
3.5
EPSS
0%
Percentile
29.9
In the wild
Unconfirmed
What it is

Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with read permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00371 · 29.9th percentile
Weakness
CWE-284 · Improper Access Control
Published
2024-06-14T15:36Z
EPSS history
Timeline
  • 14 JUN 15:36Z
    Nextcloud Server's users can delete old versions of read-only shared files
    cvelistv5