PT-2024-27809 · Nextcloud · Nextcloud Deck

Mohs3N · Published 2024-06-14 · Updated 2024-08-19 · CVE-2024-37883

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Deck versions prior to 1.6.6 Nextcloud Deck versions prior to 1.7.5 Nextcloud Deck versions prior to 1.8.7 Nextcloud Deck versions prior to 1.9.6 Nextcloud Deck versions prior to 1.11.3 Nextcloud Deck versions prior to 1.12.1

Description Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A user with access to a deck board was able to access comments and attachments of already deleted cards.

Recommendations For versions prior to 1.6.6, upgrade to version 1.6.6 or later. For versions prior to 1.7.5, upgrade to version 1.7.5 or later. For versions prior to 1.8.7, upgrade to version 1.8.7 or later. For versions prior to 1.9.6, upgrade to version 1.9.6 or later. For versions prior to 1.11.3, upgrade to version 1.11.3 or later. For versions prior to 1.12.1, upgrade to version 1.12.1 or later.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-37883

GHSA-X45G-VX69-R9M8

Affected Products

Nextcloud Deck

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37883.json · Exploit
• https://github.com/nextcloud/deck/pull/5423 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x45g-vx69-r9m8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-37883 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37883 · Vendor Advisory
• https://twitter.com/CVEnew/status/1801673785210466409 · Twitter Post
• https://hackerone.com/reports/2289333 · Note
• https://t.me/cvenotify/91127 · Telegram Post
• https://twitter.com/linuxpatch/status/1801677460972380659 · Twitter Post