Vulnerability · Published Jun 14, 2024 · Assigned by GitHub_M
CVE-2024-37883Nextcloud Deck can access comments and attachments of deleted cards
Medium 4.3
In plain English
A medium-severity improper access control in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Official description
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A user with access to a deck board was able to access comments and attachments of already deleted cards. It is recommended that the Nextcloud Deck app is upgraded to 1.6.6 or 1.7.5 or 1.8.7 or 1.9.6 or 1.11.3 or 1.12.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nextcloud | security-advisories | >= 1.6.0, < 1.6.6>= 1.7.0, < 1.7.5>= 1.8.0, < 1.8.7>= 1.9.0, < 1.9.6>= 1.10.0, < 1.11.3>= 1.11.0, < 1.12.1 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x45g-vx69-r9m8 x_refsource_CONFIRM
- https://github.com/nextcloud/deck/pull/5423 x_refsource_MISC
- https://hackerone.com/reports/2289333 x_refsource_MISC