PT-2024-27472 · Nextcloud+1 · Nextcloud Photos+3

Juliusknorr · Published 2024-06-14 · Updated 2025-01-24 · CVE-2024-37314

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 25.0.7 and prior to 26.0.2 Nextcloud Enterprise Server versions prior to 25.0.7 and prior to 26.0.2

Description Nextcloud Photos is a photo management app where users can remove photos from the album of registered users.

Recommendations For Nextcloud Server versions prior to 25.0.7, upgrade to 25.0.7 or later. For Nextcloud Server versions prior to 26.0.2, upgrade to 26.0.2 or later. For Nextcloud Enterprise Server versions prior to 25.0.7, upgrade to 25.0.7 or later. For Nextcloud Enterprise Server versions prior to 26.0.2, upgrade to 26.0.2 or later.

Exploit

Fix

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

ALT-PU-2025-1855

CVE-2024-37314

GHSA-9CHH-5PRM-WP43

Affected Products

Alt Linux

Nextcloud Enterprise Server

Nextcloud Photos

Nextcloud Server

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37314.json · Exploit
• https://github.com/nextcloud/photos/pull/1749 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9chh-5prm-wp43 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-37314 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37314 · Security Note
• https://hackerone.com/reports/1946298 · Note
• https://t.me/cvenotify/90992 · Telegram Post
• https://twitter.com/CVEnew/status/1801673791644569714 · Twitter Post
• https://twitter.com/linuxpatch/status/1801647892106461646 · Twitter Post