PT-2024-4412 · Nextcloud+1 · Nextcloud Notes+1

Arianitisufi + 2 · Published 2024-06-14 · Updated 2024-08-19 · CVE-2024-37317

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:N/AC:H/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Nextcloud Notes versions prior to 4.9.3

Description The issue is related to the possibility of sharing a folder called Notes/ with a newly created user before they log in, allowing a remote attacker to access confidential information.

Recommendations For versions prior to 4.9.3, upgrade the Nextcloud Notes app to version 4.9.3 to resolve the issue. As a temporary workaround, consider restricting access to the Notes/ folder to minimize the risk of exploitation.

Exploit

Fix

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

BDU:2024-04911

CVE-2024-37317

GHSA-WFQV-CX85-7RJX

Affected Products

Nextcloud Notes

Red Os

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37317.json · Exploit
• https://github.com/nextcloud/notes/pull/1260 · Patch
• https://bdu.fstec.ru/vul/2024-04911 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37317 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37317 · Security Note
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wfqv-cx85-7rjx · Note
• https://redos.red-soft.ru/support/secure · Note
• https://twitter.com/CVEnew/status/1801673787815170148 · Twitter Post
• https://twitter.com/linuxpatch/status/1801662678798074355 · Twitter Post
• https://t.me/cvenotify/91126 · Telegram Post
• https://hackerone.com/reports/2254151 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-nextcloud-app-notes-cve-2024-37317 · Note