CVE-2024-37315: Nextcloud Server's read-only users can restore old versions
First published: Fri Jun 14 2024(Updated: )
Nextcloud Server is a self hosted personal cloud system. An attacker with read-only access to a file is able to restore older versions of a document when the files_versions app is enabled. It is recommended that the Nextcloud Server is upgraded to 26.0.12, 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 23.0.12.16, 24.0.12.12, 25.0.13.6, 26.0.12, 27.1.7 or 28.0.3.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nextcloud Server | >=23.0.0<=23.0.12 | |
| Nextcloud Server | >=24.0.0<=24.0.12 | |
| Nextcloud Server | >=25.0.0<25.0.13 | |
| Nextcloud Server | >=26.0.0<26.0.12 | |
| Nextcloud Server | >=26.0.0<26.0.12 | |
| Nextcloud Server | >=27.0.0<27.1.7 | |
| Nextcloud Server | >=27.0.0<27.1.7 | |
| Nextcloud Server | >=28.0.0<28.0.3 | |
| Nextcloud Server | >=28.0.0<28.0.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-37315?
CVE-2024-37315 is considered a high severity vulnerability due to unauthorized access to file versions.
How do I fix CVE-2024-37315?
To fix CVE-2024-37315, upgrade your Nextcloud Server to version 26.0.12, 27.1.7, or 28.0.3.
What systems are affected by CVE-2024-37315?
CVE-2024-37315 affects Nextcloud Server versions between 23.0.0 and 26.0.12, as well as certain versions of 27 and 28.
What is the impact of CVE-2024-37315?
The impact of CVE-2024-37315 allows attackers with read-only file access to restore older document versions, potentially leading to data exposure.
Is the files_versions app related to CVE-2024-37315?
Yes, CVE-2024-37315 specifically affects the files_versions app in Nextcloud Server, enabling unauthorized version restoration.
- agent/weakness
- agent/title
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/nextcloud
- canonical/nextcloud server
- version/nextcloud server/23.0.0
- version/nextcloud server/23.0.12
- version/nextcloud server/24.0.0
- version/nextcloud server/24.0.12
- version/nextcloud server/25.0.0
- version/nextcloud server/26.0.0
- version/nextcloud server/27.0.0
- version/nextcloud server/28.0.0