CVE-2024-37317
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-37317
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-37317.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-37317
- Aliases
-
- GHSA-wfqv-cx85-7rjx
- Published
- 2024-06-14T15:25:24Z
- Modified
- 2025-11-04T20:24:21.015933Z
- Severity
-
- 4.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L CVSS Calculator
- Summary
- Nextcloud Notes app can be tricked into using a received share created before the user logged in
- Details
-
The Nextcloud Notes app is a distraction free notes taking app for Nextcloud. If an attacker managed to share a folder called
Notes/with a newly created user before they logged in, the Notes app would use that folder store the personal notes. It is recommended that the Nextcloud Notes app is upgraded to 4.9.3. - Database specific
{ "cwe_ids": [ "CWE-284" ] }- References