Skip to content
OpenAdvisories
High WID-SEC-2024-1389 12 CVEs

Nextcloud: Mehrere Schwachstellen

Published Jun 16, 2024 · Updated Jun 16, 2024 · de-DE

Vendor: Nextcloud Product: Nextcloud Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Nextcloud ausnutzen, um Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen, die Rechte zu erweitern und Dateien zu manipulieren.

Product

Nextcloud ist eine "on-premise" Plattform für Dateifreigabe und Zusammenarbeit.

Vulnerabilities 12

  • High 8.1
    CVE-2024-37882

    Nextcloud Server can reshare read&share only folder with more permissions

    Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4 and that the Nextc…

    Nextcloud security-advisories
  • High 7.3
    CVE-2024-37313

    Nextcloud server allows the by-pass the second factor

    Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providing the user credentials. It is recommended that the Nextcloud Server is upgraded to 26.0.13, 27.1.8 o…

    Nextcloud security-advisories
  • Medium 6.3
    CVE-2024-37312

    Nextcloud user_oidc app's ID4me feature is available even when disabled

    user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventually getting access to data that is available to all registered users. It is recommended that the OpenI…

    Nextcloud security-advisories
  • Medium 5.4
    CVE-2024-37886

    Nextcloud user_oidc's ID4me does not validate signature or expiration

    user_oidc app is an OpenID Connect user backend for Nextcloud. An attacker could potentially trick the app into accepting a request that is not signed by the correct server. It is recommended that the Nextcloud user_oidc app is upgraded to 1.3.5, 2.0.0, 3.0.0…

    Nextcloud security-advisories
  • Medium 4.6
    CVE-2024-37316

    Nextcloud Calendar's event create can create attachments that link to other websites

    Nextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated attachment data leading to a bad redirect for participants when clicked. It is recommended that the Nextcloud Calendar App is upgraded to 4.6.8 or 4…

    Nextcloud security-advisories
  • Medium 4.6
    CVE-2024-37317

    Nextcloud Notes app can be tricked into using a received share created before the user logged in

    The Nextcloud Notes app is a distraction free notes taking app for Nextcloud. If an attacker managed to share a folder called `Notes/` with a newly created user before they logged in, the Notes app would use that folder store the personal notes. It is recomme…

    Nextcloud security-advisories
  • Medium 4.3
    CVE-2024-37883

    Nextcloud Deck can access comments and attachments of deleted cards

    Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A user with access to a deck board was able to access comments and attachments of already deleted cards. It is recommen…

    Nextcloud security-advisories
  • Low 3.8
    CVE-2024-37885

    Code injection in Nextcloud Desktop Client for macOS

    The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop Client for macOS allowed to load arbitrary code when starting the client with DYLD_INSERT_LIBRARIES set in the envirome…

    Nextcloud security-advisories
  • Low 3.5
    CVE-2024-37314

    Nextcloud Photos' shared albums have no restriction on photo removal

    Nextcloud Photos is a photo management app. Users can remove photos from the album of registered users. It is recommended that the Nextcloud Server is upgraded to 25.0.7 or 26.0.2 and the Nextcloud Enterprise Server is upgraded to 25.0.7 or 26.0.2.

    Nextcloud security-advisories
  • Low 3.5
    CVE-2024-37315

    Nextcloud Server's read-only users can restore old versions

    Nextcloud Server is a self hosted personal cloud system. An attacker with read-only access to a file is able to restore older versions of a document when the files_versions app is enabled. It is recommended that the Nextcloud Server is upgraded to 26.0.12, 27…

    Nextcloud security-advisories
  • Low 3.5
    CVE-2024-37884

    Nextcloud Server's users can delete old versions of read-only shared files

    Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with read permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.12 or 27.1.7 or 28…

    Nextcloud security-advisories
  • Low 3.5
    CVE-2024-37887

    Nextcloud Server's events information leaked with shared calendars on recurrence exceptions

    Nextcloud Server is a self hosted personal cloud system. Private shared calendar events' recurrence exceptions can be read by sharees. It is recommended that the Nextcloud Server is upgraded to 27.1.10 or 28.0.6 or 29.0.1 and that the Nextcloud Enterprise Ser…

    Nextcloud security-advisories

Revision history

  1. #1

    Initiale Fassung

References