Users can delete old versions of read-only shared files

🗓️ 14 Jun 2024 14:34:03Reported by NextcloudType

Users can delete old versions of read-only shared files. Malicious user can send delete requests for old versions. Nextcloud Server and Enterprise should be upgraded. Versions app should be disabled

Reporter	Title	Published	Views	Family All 49
BDU FSTEC	The vulnerability of the Delete component in the cloud software for creating and using Nextcloud Server’s data storage allows a attacker to cause a service failure.	28 Jun 202400:00	–	bdu_fstec
CNNVD	Nextcloud Security Breach	14 Jun 202400:00	–	cnnvd
CVE	CVE-2024-37884	14 Jun 202415:36	–	cve
Cvelist	CVE-2024-37884 Nextcloud Server's users can delete old versions of read-only shared files	14 Jun 202415:36	–	cvelist
EUVD	EUVD-2024-36868	3 Oct 202520:07	–	euvd
Hacker One	Nextcloud: Re-emergence of Security Vulnerability in Nextcloud Version 28 Previously Fixed in 25.0.4	18 Dec 202316:31	–	hackerone
NVD	CVE-2024-37884	14 Jun 202416:15	–	nvd
OpenVAS	Nextcloud Server < 25.0.13.7, 26.x < 26.0.13, 27.x < 27.1.8, 28.x < 28.0.4 Improper Access Control Vulnerability (GHSA-xwgx-f37p-xh8c)	19 Jun 202400:00	–	openvas
OSV	CVE-2024-37884 Nextcloud Server's users can delete old versions of read-only shared files	14 Jun 202415:36	–	osv
Positive Technologies	PT-2023-27175 · Nextcloud +1 · Nextcloud Server +1	10 Aug 202300:00	–	ptsecurity