CVE-2024-37882

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4 and that the Nextcloud Enterprise Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-284 CWE-281

Affected software

Vendor	Product	Versions
nextcloud	security-advisories	>= 26.0.0, < 26.0.13; >= 27.0.0, < 27.1.8; >= 28.0.0, < 28.0.4

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jjm3-j9xh-5xmqVendor Advisory
https://github.com/nextcloud/server/pull/44339Patch
https://hackerone.com/reports/2289425Issue Tracking
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jjm3-j9xh-5xmqVendor Advisory
https://github.com/nextcloud/server/pull/44339Patch
https://hackerone.com/reports/2289425Issue Tracking

Timeline

Published: Jun 14, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-378834.3Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. CVE-2024-378845.4Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they on CVE-2024-378857.8The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop CVE-2024-378864.7user_oidc app is an OpenID Connect user backend for Nextcloud. An attacker could potentially trick the app into accepting a request that is CVE-2024-378873.5Nextcloud Server is a self hosted personal cloud system. Private shared calendar events' recurrence exceptions can be read by sharees. It is CVE-2024-378886.1The Open Link is a CKEditor plugin, extending context menu with a possibility to open link in a new tab. The vulnerability allowed to execut CVE-2024-378896.5MyFinances is a web application for managing finances. MyFinances has a way to access other customer invoices while signed in as a user. Thi CVE-2024-37896.5Uncontrolled resource consumption vulnerability in White Bear Solutions WBSAirback, version 21.02.04. This vulnerability could allow an atta CVE-2024-378907.5ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount thresho CVE-2024-378916.5urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization`CVE-2024-378935.9Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow m CVE-2024-378946.3Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables