DeutschShown in its original language — a full translation is planned for a future version.
Nextcloud: Mehrere Schwachstellen
view advisory published 2024-06-16
Ein Angreifer kann mehrere Schwachstellen in Nextcloud ausnutzen, um Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen, die Rechte zu erweitern und Dateien zu manipulieren.
01
describes (12)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-37887US | low3.5 | — | ||
Nextcloud Server is a self hosted personal cloud system. Private shared calendar events' recurrence exceptions can be read by sharees. It is recommended that the Nextcloud Server i… | ||||
| CVE-2024-37886US | medium4.7 | — | ||
user_oidc app is an OpenID Connect user backend for Nextcloud. An attacker could potentially trick the app into accepting a request that is not signed by the correct server. It is… | ||||
| CVE-2024-37885US | high7.8 | — | ||
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop Client for macOS allowed to load arbitra… | ||||
| CVE-2024-37884US | medium5.4 | — | ||
Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with read permissions. It… | ||||
| CVE-2024-37883US | medium4.3 | — | ||
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A user with access to a deck board was a… | ||||
| CVE-2024-37882US | high8.1 | — | ||
Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more permissions. It is recommended that the… | ||||
| CVE-2024-37317US | medium4.6OT elevated | — | ||
The Nextcloud Notes app is a distraction free notes taking app for Nextcloud. If an attacker managed to share a folder called `Notes/` with a newly created user before they logged… | ||||
| CVE-2024-37316US | medium4.6 | — | ||
Nextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated attachment data leading to a bad redirect for participants when click… | ||||
| CVE-2024-37315US | medium4.3 | — | ||
Nextcloud Server is a self hosted personal cloud system. An attacker with read-only access to a file is able to restore older versions of a document when the files_versions app is… | ||||
| CVE-2024-37314US | low3.5OT elevated | — | ||
Nextcloud Photos is a photo management app. Users can remove photos from the album of registered users. It is recommended that the Nextcloud Server is upgraded to 25.0.7 or 26.0.2… | ||||
| CVE-2024-37313US | high7.5 | — | ||
Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providing the user credential… | ||||
| CVE-2024-37312US | medium6.3 | — | ||
user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventually getting access to d… | ||||
02
references
External citations — patches, advisories, analysis.
- Nextcloud Security Advisory GHSA-2r7q-vfmv-79qf vom 2024-06-16external
- Nextcloud Security Advisory GHSA-4mf7-v63m-99p7 vom 2024-06-16external
- Nextcloud Security Advisory GHSA-5mq8-738w-5942 vom 2024-06-16external
- Nextcloud Security Advisory GHSA-9chh-5prm-wp43 vom 2024-06-16external
- Nextcloud Security Advisory GHSA-9v72-9xv5-3p7c vom 2024-06-16external
- Nextcloud Security Advisory GHSA-h4xv-cjpm-j595 vom 2024-06-16external
- Nextcloud Security Advisory GHSA-jjm3-j9xh-5xmq vom 2024-06-16external
- Nextcloud Security Advisory GHSA-vw5h-29xf-g55g vom 2024-06-16external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan