Nextcloud Notes 4.9.2: Shared Notes/ Folder Enables Personal Note Storage
CVE-2024-37317 Published on June 14, 2024
Nextcloud Notes app can be tricked into using a received share created before the user logged in
The Nextcloud Notes app is a distraction free notes taking app for Nextcloud. If an attacker managed to share a folder called `Notes/` with a newly created user before they logged in, the Notes app would use that folder store the personal notes. It is recommended that the Nextcloud Notes app is upgraded to 4.9.3.
Vulnerability Analysis
CVE-2024-37317 can be exploited with network access, requires user interaction and a small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be low. considered to have a small impact on confidentiality and integrity and availability.
Weakness Type
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2024-37317 has been classified to as an Authorization vulnerability or weakness.
Products Associated with CVE-2024-37317
Want to know whenever a new CVE is published for Nextcloud Notes? stack.watch will email you.
Affected Versions
nextcloud security-advisories Version >= 4.6.0, < 4.9.3 is affected by CVE-2024-37317Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.