CVE-2024-37883
Estado: ModificadaMedia (4.3)—
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A user with access to a deck board was able to access comments and attachments of already deleted cards. It is recommended that the Nextcloud Deck app is upgraded to 1.6.6 or 1.7.5 or 1.8.7 or 1.9.6 or 1.11.3 or 1.12.1.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Puntuación base: 4.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.38%
- Percentil entre todas las CVEs puntuadas: 30
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-284
- NVD-CWE-noinfo
Referencias
- https://github.com/nextcloud/deck/pull/5423
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x45g-vx69-r9m8
- https://hackerone.com/reports/2289333
- https://github.com/nextcloud/deck/pull/5423
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x45g-vx69-r9m8
- https://hackerone.com/reports/2289333
JSON original (NVD)
Mostrar
{
"id": "CVE-2024-37883",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-37883",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-06-17T14:44:25.886426Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "security-advisories@github.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 4.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 1.4,
"exploitabilityScore": 2.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 4.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 1.4,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "security-advisories@github.com",
"affectedData": [
{
"vendor": "nextcloud",
"product": "security-advisories",
"versions": [
{
"status": "affected",
"version": ">= 1.6.0, < 1.6.6"
},
{
"status": "affected",
"version": ">= 1.7.0, < 1.7.5"
},
{
"status": "affected",
"version": ">= 1.8.0, < 1.8.7"
},
{
"status": "affected",
"version": ">= 1.9.0, < 1.9.6"
},
{
"status": "affected",
"version": ">= 1.10.0, < 1.11.3"
},
{
"status": "affected",
"version": ">= 1.11.0, < 1.12.1"
}
]
}
]
}
],
"published": "2024-06-14T16:15:13.107",
"references": [
{
"url": "https://github.com/nextcloud/deck/pull/5423",
"tags": [
"Patch"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x45g-vx69-r9m8",
"tags": [
"Patch",
"Third Party Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://hackerone.com/reports/2289333",
"tags": [
"Issue Tracking"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/nextcloud/deck/pull/5423",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x45g-vx69-r9m8",
"tags": [
"Patch",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://hackerone.com/reports/2289333",
"tags": [
"Issue Tracking"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "security-advisories@github.com",
"description": [
{
"lang": "en",
"value": "CWE-284"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A user with access to a deck board was able to access comments and attachments of already deleted cards. It is recommended that the Nextcloud Deck app is upgraded to 1.6.6 or 1.7.5 or 1.8.7 or 1.9.6 or 1.11.3 or 1.12.1."
},
{
"lang": "es",
"value": "Nextcloud Deck es una herramienta de organización estilo kanban destinada a la planificación personal y organización de proyectos para equipos integrada con Nextcloud. Un usuario con acceso a un tablero pudo acceder a comentarios y archivos adjuntos de tarjetas ya eliminadas. Se recomienda actualizar la aplicación Nextcloud Deck a 1.6.6 o 1.7.5 o 1.8.7 o 1.9.6 o 1.11.3 o 1.12.1."
}
],
"lastModified": "2026-06-17T07:38:59.013",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nextcloud:deck:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "86DB4960-7283-4CD7-A38D-B66EC985115B",
"versionEndExcluding": "1.6.6",
"versionStartIncluding": "1.6.0"
},
{
"criteria": "cpe:2.3:a:nextcloud:deck:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D8ACE2CB-E8D7-461D-B062-1B345B45BBA5",
"versionEndExcluding": "1.7.5",
"versionStartIncluding": "1.7.0"
},
{
"criteria": "cpe:2.3:a:nextcloud:deck:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4AB8CBAE-FBDA-4936-AB07-62C2C8257E5A",
"versionEndExcluding": "1.8.7",
"versionStartIncluding": "1.8.0"
},
{
"criteria": "cpe:2.3:a:nextcloud:deck:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5FE406E6-6A94-468F-98E0-968DFE18AA18",
"versionEndExcluding": "1.9.6",
"versionStartIncluding": "1.9.0"
},
{
"criteria": "cpe:2.3:a:nextcloud:deck:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D50AE4C5-AA92-4ACF-812B-DACB105F414A",
"versionEndExcluding": "1.11.3",
"versionStartIncluding": "1.11.0"
},
{
"criteria": "cpe:2.3:a:nextcloud:deck:1.12.0:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BD7E4779-597B-4E00-A713-81D8ABEA34F2"
},
{
"criteria": "cpe:2.3:a:nextcloud:deck:1.12.0:beta1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "565EBC05-6185-4843-8FE0-354DBAA333E7"
},
{
"criteria": "cpe:2.3:a:nextcloud:deck:1.12.0:beta2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E197450E-BF35-4609-82AC-57EA158923C1"
},
{
"criteria": "cpe:2.3:a:nextcloud:deck:1.12.0:beta3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AE6D6357-73F1-4DAB-AA8D-567EC7A1FAEE"
},
{
"criteria": "cpe:2.3:a:nextcloud:deck:1.12.0:beta4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7F190A44-F19A-4A58-9C48-A0AAB366C5E6"
},
{
"criteria": "cpe:2.3:a:nextcloud:deck:1.12.0:beta5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E217E9CB-9724-4FC5-A40F-EDDED1C32FE0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security-advisories@github.com"
}