CVE-2024-37315: Nextcloud Server's read-only users can restore old versions
Nextcloud Server is a self hosted personal cloud system. An attacker with read-only access to a file is able to restore older versions of a document when the filesversions app is enabled. It is recommended that the Nextcloud Server is upgraded to 26.0.12, 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 23.0.12.16, 24.0.12.12, 25.0.13.6, 26.0.12, 27.1.7 or 28.0.3.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37315?
CVE-2024-37315 is considered a high severity vulnerability due to unauthorized access to file versions.
How do I fix CVE-2024-37315?
To fix CVE-2024-37315, upgrade your Nextcloud Server to version 26.0.12, 27.1.7, or 28.0.3.
What systems are affected by CVE-2024-37315?
CVE-2024-37315 affects Nextcloud Server versions between 23.0.0 and 26.0.12, as well as certain versions of 27 and 28.
What is the impact of CVE-2024-37315?
The impact of CVE-2024-37315 allows attackers with read-only file access to restore older document versions, potentially leading to data exposure.
Is the files_versions app related to CVE-2024-37315?
Yes, CVE-2024-37315 specifically affects the files_versions app in Nextcloud Server, enabling unauthorized version restoration.