CVE-2024-37883

2024-06-1416:15:13

CWE-284

[email protected]

web.nvd.nist.gov

nextcloud

deck

vulnerability

unauthorized access

deleted cards

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.5%

JSON

Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A user with access to a deck board was able to access comments and attachments of already deleted cards. It is recommended that the Nextcloud Deck app is upgraded to 1.6.6 or 1.7.5 or 1.8.7 or 1.9.6 or 1.11.3 or 1.12.1.

Affected configurations

Vulners

Node

nextcloudnextcloudRange1.6.0–1.6.6

nextcloudnextcloudRange1.7.0–1.7.5

nextcloudnextcloudRange1.8.0–1.8.7

nextcloudnextcloudRange1.9.0–1.9.6

nextcloudnextcloudRange1.10.0–1.11.3

nextcloudnextcloudRange1.11.0–1.12.1

CNA Affected

[
  {
    "vendor": "nextcloud",
    "product": "security-advisories",
    "versions": [
      {
        "version": ">= 1.6.0, < 1.6.6",
        "status": "affected"
      },
      {
        "version": ">= 1.7.0, < 1.7.5",
        "status": "affected"
      },
      {
        "version": ">= 1.8.0, < 1.8.7",
        "status": "affected"
      },
      {
        "version": ">= 1.9.0, < 1.9.6",
        "status": "affected"
      },
      {
        "version": ">= 1.10.0, < 1.11.3",
        "status": "affected"
      },
      {
        "version": ">= 1.11.0, < 1.12.1",
        "status": "affected"
      }
    ]
  }
]