CVE-2024-37884: Nextcloud Server's users can delete old versions of read-only shared files
First published: Fri Jun 14 2024(Updated: )
Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with read permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nextcloud Server | >=25.0.0<25.0.13.7 | |
| Nextcloud Server | >=26.0.0<26.0.13 | |
| Nextcloud Server | >=26.0.0<26.0.13 | |
| Nextcloud Server | >=27.0.0<27.1.8 | |
| Nextcloud Server | >=27.0.0<27.1.8 | |
| Nextcloud Server | >=28.0.0<28.0.4 | |
| Nextcloud Server | >=28.0.0<28.0.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-37884?
The severity of CVE-2024-37884 is classified as high due to the impact of allowing unauthorized deletion of file versions.
How do I fix CVE-2024-37884?
To fix CVE-2024-37884, upgrade to Nextcloud Server version 26.0.12, 27.1.7, or 28.0.3.
Who is affected by CVE-2024-37884?
CVE-2024-37884 affects users of Nextcloud Server versions prior to 26.0.12, 27.1.7, or 28.0.3.
What is the exploit method for CVE-2024-37884?
CVE-2024-37884 allows a malicious user with read permissions to send delete requests for old file versions.
What are the recommended actions after identifying CVE-2024-37884?
After identifying CVE-2024-37884, it is recommended to immediately upgrade the Nextcloud Server to a patched version.
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- agent/severity
- agent/remedy
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/nextcloud
- canonical/nextcloud server
- version/nextcloud server/25.0.0
- version/nextcloud server/26.0.0
- version/nextcloud server/27.0.0
- version/nextcloud server/28.0.0