CVE-2024-37887: Nextcloud Server's events information leaked with shared calendars on recurrence exceptions
First published: Fri Jun 14 2024(Updated: )
Nextcloud Server is a self hosted personal cloud system. Private shared calendar events' recurrence exceptions can be read by sharees. It is recommended that the Nextcloud Server is upgraded to 27.1.10 or 28.0.6 or 29.0.1 and that the Nextcloud Enterprise Server is upgraded to 27.1.10 or 28.0.6 or 29.0.1.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nextcloud Server | >=27.0.0<27.1.10 | |
| Nextcloud Server | >=27.0.0<27.1.10 | |
| Nextcloud Server | >=28.0.0<=28.0.6 | |
| Nextcloud Server | >=28.0.0<28.0.6 | |
| Nextcloud Server | =29.0.0 | |
| Nextcloud Server | =29.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-37887?
CVE-2024-37887 has been classified as a moderate severity vulnerability affecting the recurrence exceptions of private shared calendar events in Nextcloud Server.
How do I fix CVE-2024-37887?
To fix CVE-2024-37887, upgrade your Nextcloud Server to versions 27.1.10, 28.0.6, or 29.0.1.
Who is affected by CVE-2024-37887?
CVE-2024-37887 affects users of Nextcloud Server versions between 27.0.0 and 27.1.10, 28.0.0 and 28.0.6, and the exact version 29.0.0.
What types of data are exposed due to CVE-2024-37887?
CVE-2024-37887 exposes the recurrence exceptions of private shared calendar events, which can be accessed by users who are granted share access.
Is there a specific version I need for the Nextcloud Enterprise Server to address CVE-2024-37887?
Yes, Nextcloud Enterprise Server users should upgrade to version 27.1.1 or later to address CVE-2024-37887.
- agent/weakness
- agent/references
- agent/title
- agent/description
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/nextcloud
- canonical/nextcloud server
- version/nextcloud server/27.0.0
- version/nextcloud server/28.0.0
- version/nextcloud server/28.0.6
- version/nextcloud server/29.0.0