CVE-2024-37884 Nextcloud Server's users can delete old versions of read-only shared files

🗓️ 14 Jun 2024 15:36:16Reported by GitHub_MType

Nextcloud Server vulnerability allows deletion of read-only shared file

Reporter	Title	Published	Views	Family All 49
BDU FSTEC	The vulnerability of the Delete component in the cloud software for creating and using Nextcloud Server’s data storage allows a attacker to cause a service failure.	28 Jun 202400:00	–	bdu_fstec
CNNVD	Nextcloud Security Breach	14 Jun 202400:00	–	cnnvd
CVE	CVE-2024-37884	14 Jun 202415:36	–	cve
EUVD	EUVD-2024-36868	3 Oct 202520:07	–	euvd
Nextcloud	Users can delete old versions of read-only shared files	14 Jun 202414:34	–	nextcloud
Hacker One	Nextcloud: Re-emergence of Security Vulnerability in Nextcloud Version 28 Previously Fixed in 25.0.4	18 Dec 202316:31	–	hackerone
NVD	CVE-2024-37884	14 Jun 202416:15	–	nvd
OpenVAS	Nextcloud Server < 25.0.13.7, 26.x < 26.0.13, 27.x < 27.1.8, 28.x < 28.0.4 Improper Access Control Vulnerability (GHSA-xwgx-f37p-xh8c)	19 Jun 202400:00	–	openvas
OSV	CVE-2024-37884 Nextcloud Server's users can delete old versions of read-only shared files	14 Jun 202415:36	–	osv
Positive Technologies	PT-2023-27175 · Nextcloud +1 · Nextcloud Server +1	10 Aug 202300:00	–	ptsecurity

[
  {
    "vendor": "nextcloud",
    "product": "security-advisories",
    "versions": [
      {
        "version": ">= 26.0.0, < 26.0.13",
        "status": "affected"
      },
      {
        "version": ">= 27.0.0, < 27.1.8",
        "status": "affected"
      },
      {
        "version": ">= 28.0.0, < 28.0.4",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/nextcloud/server/pull/43727
github	www.github.com/nextcloud/security-advisories/security/advisories/GHSA-xwgx-f37p-xh8c
hackerone	www.hackerone.com/reports/2290680

14 Jun 2024 15:36Current

CVSS 3.13.5

EPSS0.00371

CWE-284