CVE-2024-37317
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-37317
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-37317.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-37317
- Aliases
-
- GHSA-wfqv-cx85-7rjx
- Published
- 2024-06-14T15:25:24.475Z
- Modified
- 2025-11-30T18:40:25.649190Z
- Severity
-
- 4.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L CVSS Calculator
- Summary
- Nextcloud Notes app can be tricked into using a received share created before the user logged in
- Details
-
The Nextcloud Notes app is a distraction free notes taking app for Nextcloud. If an attacker managed to share a folder called
Notes/with a newly created user before they logged in, the Notes app would use that folder store the personal notes. It is recommended that the Nextcloud Notes app is upgraded to 4.9.3. - Database specific
{ "cwe_ids": [ "CWE-284" ], "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37317.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37317.json
- https://github.com/nextcloud/notes/pull/1260
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wfqv-cx85-7rjx
- https://hackerone.com/reports/2254151
- https://nvd.nist.gov/vuln/detail/CVE-2024-37317