CVE-2024-37314

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-37314
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-37314.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-37314
Aliases
  • GHSA-9chh-5prm-wp43
Published
2024-06-14T15:05:48.284Z
Modified
2025-11-30T18:37:45.815853Z
Severity
  • 3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Nextcloud Photos' shared albums have no restriction on photo removal
Details

Nextcloud Photos is a photo management app. Users can remove photos from the album of registered users. It is recommended that the Nextcloud Server is upgraded to 25.0.7 or 26.0.2 and the Nextcloud Enterprise Server is upgraded to 25.0.7 or 26.0.2.

Database specific 
{
    "cwe_ids": [
        "CWE-284"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37314.json"
}
References

Affected packages

Git / github.com/nextcloud/photos

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/photos
Events
Introduced
73a7196d45713c43ec59902e302ed9ead171f37f
Fixed
12685bc42d5d2d169e2444e5f7388f85cb9c640a
Database specific 
{
    "versions": [
        {
            "introduced": "25.0.1"
        },
        {
            "fixed": "25.0.7"
        }
    ]
}
Type
GIT
Repo
https://github.com/nextcloud/photos
Events
Introduced
48ce38f3f0cbaa0381fe35e52781fc32181c77e6
Fixed
1b8874478180b55121cb65e3e1de3022701ed712
Database specific 
{
    "versions": [
        {
            "introduced": "26.0.0"
        },
        {
            "fixed": "26.0.2"
        }
    ]
}

Affected versions

v25.*

v25.0.1
v25.0.2
v25.0.2rc1
v25.0.2rc2
v25.0.2rc3
v25.0.3
v25.0.3rc1
v25.0.3rc2
v25.0.4
v25.0.4rc1
v25.0.5
v25.0.5rc1
v25.0.6
v25.0.6rc1
v25.0.7rc1

v26.*

v26.0.0
v26.0.1
v26.0.1rc1
v26.0.2rc1

Git / github.com/nextcloud/server

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/server
Events
Introduced
20ea9a25353129b56d46951fe7d23939665ab2b2
Fixed
f14c1100ecae34309931be4c51c8d82296ad17d2

Affected versions

v25.*

v25.0.0
v25.0.1
v25.0.1rc1
v25.0.2
v25.0.2rc1
v25.0.2rc2
v25.0.2rc3
v25.0.3
v25.0.3rc1
v25.0.3rc2
v25.0.4
v25.0.4rc1
v25.0.5
v25.0.5rc1
v25.0.6
v25.0.6rc1
v25.0.7rc1