FKIE_CVE-2024-37882

Vulnerability from fkie_nvd - Published: 2024-06-14 16:15 - Updated: 2024-11-21 09:24
Severity ?
8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Summary
Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4 and that the Nextcloud Enterprise Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4.
References
security-advisories@github.comhttps://github.com/nextcloud/security-advisories/security/advisories/GHSA-jjm3-j9xh-5xmqVendor Advisory
security-advisories@github.comhttps://github.com/nextcloud/server/pull/44339Patch
security-advisories@github.comhttps://hackerone.com/reports/2289425Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jjm3-j9xh-5xmqVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/nextcloud/server/pull/44339Patch
af854a3a-2127-422b-91ae-364da2661108https://hackerone.com/reports/2289425Issue Tracking
Impacted products
Vendor Product Version
nextcloud nextcloud_server *
nextcloud nextcloud_server *
nextcloud nextcloud_server *
nextcloud nextcloud_server *
nextcloud nextcloud_server *
nextcloud nextcloud_server *
nextcloud nextcloud_server *
nextcloud nextcloud_server *
nextcloud nextcloud_server *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*",
              "matchCriteriaId": "8F643317-2586-435E-8D89-721BC6161691",
              "versionEndExcluding": "26.0.13",
              "versionStartIncluding": "26.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*",
              "matchCriteriaId": "8696DA00-5B0C-45F5-BD50-9FF1F5E4646F",
              "versionEndExcluding": "27.1.8",
              "versionStartIncluding": "27.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*",
              "matchCriteriaId": "C3A816F7-5D5E-43CB-9C53-E4C5B1344C84",
              "versionEndExcluding": "28.0.4",
              "versionStartIncluding": "28.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "ED4378AE-1AD4-4E15-A64C-E4028FCD098F",
              "versionEndExcluding": "23.0.12.17",
              "versionStartIncluding": "23.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "20A172FB-2E26-4ADD-BA55-0ECC5E5FCFD1",
              "versionEndExcluding": "24.0.12.13",
              "versionStartIncluding": "24.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "7D2923A6-9A3C-4B66-82D4-E02A0E8F16A4",
              "versionEndExcluding": "25.0.13.8",
              "versionStartIncluding": "25.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "6909C63C-3755-4B68-B90E-4C5E14C78787",
              "versionEndExcluding": "26.0.13",
              "versionStartIncluding": "26.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "B6C25B03-B587-4F48-BE81-052AF67E2045",
              "versionEndExcluding": "27.1.8",
              "versionStartIncluding": "27.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "E04001FE-890B-4D94-B679-B0854E840F39",
              "versionEndExcluding": "28.0.4",
              "versionStartIncluding": "28.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read\u0026share permissions could reshare the item with more permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4 and that the Nextcloud Enterprise Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4."
    },
    {
      "lang": "es",
      "value": "Nextcloud Server es un sistema de nube personal autohospedado. Un destinatario de un recurso compartido con permisos de lectura y uso compartido podr\u00eda volver a compartir el elemento con m\u00e1s permisos. Se recomienda que Nextcloud Server se actualice a 26.0.13 o 27.1.8 o 28.0.4 y que Nextcloud Enterprise Server se actualice a 26.0.13 o 27.1.8 o 28.0.4."
    }
  ],
  "id": "CVE-2024-37882",
  "lastModified": "2024-11-21T09:24:27.723",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-06-14T16:15:12.863",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jjm3-j9xh-5xmq"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/nextcloud/server/pull/44339"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://hackerone.com/reports/2289425"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jjm3-j9xh-5xmq"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/nextcloud/server/pull/44339"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://hackerone.com/reports/2289425"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-281"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.