CVE-2024-37883

MEDIUM

Nextcloud Deck 1.6.0-1.6.5 - Unauthorized Access to Deleted Card Comments and Attachments

Title source: llm
STIX 2.1

Description

Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A user with access to a deck board was able to access comments and attachments of already deleted cards. It is recommended that the Nextcloud Deck app is upgraded to 1.6.6 or 1.7.5 or 1.8.7 or 1.9.6 or 1.11.3 or 1.12.1.

References (3)

Core 3
Core References
Issue Tracking x_refsource_misc
https://hackerone.com/reports/2289333

Scores

CVSS v3 4.3
EPSS 0.0014
EPSS Percentile 34.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-284
Status published
Products (2)
nextcloud/deck 1.12.0 (6 CPE variants)
nextcloud/deck 1.6.0 - 1.6.6
Published Jun 14, 2024
Tracked Since Feb 18, 2026