CVE-2024-37887
- Source
- https://cve.org/CVERecord?id=CVE-2024-37887
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-37887.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-37887
- Aliases
-
- GHSA-h4xv-cjpm-j595
- Published
- 2024-06-14T15:48:11.867Z
- Modified
- 2026-07-15T02:11:53.032305585Z
- Severity
-
- 3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- Nextcloud Server's events information leaked with shared calendars on recurrence exceptions
- Details
-
Nextcloud Server is a self hosted personal cloud system. Private shared calendar events' recurrence exceptions can be read by sharees. It is recommended that the Nextcloud Server is upgraded to 27.1.10 or 28.0.6 or 29.0.1 and that the Nextcloud Enterprise Server is upgraded to 27.1.10 or 28.0.6 or 29.0.1.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37887.json", "cwe_ids": [ "CWE-284" ], "cna_assigner": "GitHub_M" }- References
-
- https://hackerone.com/reports/2479325
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37887.json
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h4xv-cjpm-j595
- https://nvd.nist.gov/vuln/detail/CVE-2024-37887
- https://github.com/nextcloud/server/pull/45309
Affected packages
Git / github.com/nextcloud/server
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nextcloud/server
- Events
-
IntroducedFixedIntroducedFixedIntroducedLast affected
- Database specific
{ "cpe": [ "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*", "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*", "cpe:2.3:a:nextcloud:nextcloud_server:29.0.0:-:*:*:-:*:*:*", "cpe:2.3:a:nextcloud:nextcloud_server:29.0.0:-:*:*:enterprise:*:*:*" ], "source": [ "CPE_RANGE", "CPE_STRING" ], "extracted_events": [ { "introduced": "27.0.0" }, { "fixed": "27.1.10" }, { "introduced": "28.0.0" }, { "last_affected": "28.0.6" }, { "fixed": "28.0.6" }, { "introduced": "29.0.0-NA" }, { "last_affected": "29.0.0-NA" } ] }
Affected versions
29.*
29.0.0-NA
v27.*
v27.0.0
v27.0.1
v27.0.1rc1
v27.0.1rc2
v27.0.2
v27.0.2rc1
v27.1.0
v27.1.0beta2
v27.1.0beta3
v27.1.0rc1
v27.1.0rc2
v27.1.0rc3
v27.1.0rc4
v27.1.1
v27.1.10rc1
v27.1.10rc2
v27.1.2
v27.1.2rc1
v27.1.3
v27.1.3rc1
v27.1.3rc2
v27.1.4
v27.1.4rc1
v27.1.5
v27.1.5rc1
v27.1.6
v27.1.6rc1
v27.1.6rc2
v27.1.7
v27.1.7rc1
v27.1.7rc2
v27.1.8
v27.1.8rc1
v27.1.9
v27.1.9rc1
v28.*
v28.0.0
v28.0.1
v28.0.1rc1
v28.0.2
v28.0.2rc1
v28.0.2rc2
v28.0.2rc3
v28.0.2rc4
v28.0.2rc5
v28.0.3
v28.0.3rc1
v28.0.3rc2
v28.0.4
v28.0.4rc1
v28.0.5
v28.0.5rc1
v28.0.6rc1
v29.*
v29.0.0