Vulnerability · Published Nov 15, 2024 · Assigned by GitHub_M
CVE-2024-52507Share information of the Nextcloud Tables app is not limited to affected users
Low 3.5
In plain English
A low-severity authorization bypass via user-controlled key in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.4%top 61.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Nextcloud Tables allows users to to create tables with individual columns. The information which Table (numeric ID) is shared with which groups and users and the respective permissions was not limited to affected users. It is recommended that the Nextcloud Tables app is upgraded to 0.8.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nextcloud | security-advisories | >= 0.3.0, < 0.8.1 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-rgvc-xr2w-qq45 x_refsource_CONFIRM
- https://github.com/nextcloud/tables/pull/1406 x_refsource_MISC
- https://github.com/nextcloud/tables/commit/13ca45f1b9f70f694aea81b78bc7416ec840c332 x_refsource_MISC
- https://hackerone.com/reports/2705507 x_refsource_MISC