Critical severity · published Sep 16, 2024
CVE-2024-46958
In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or world readable
9.1
CVSS
0.6%
EPSS
No
On KEV
Description
In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or world readable. This is fixed in 3.13.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DE
Desktop · Nextcloud
3.13.1 before 3.13.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-46958
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-46958
Patch
https://github.com/nextcloud/desktop/compare/v3.13.3...v3.13.4
Issue Tracking
https://github.com/nextcloud/desktop/issues/6863
Issue Tracking
https://github.com/nextcloud/desktop/pull/6949
Patch
https://github.com/nextcloud/desktop/pull/7092
Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories
More from Desktop
8.8
CVE-2023-22472
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud
8.8
CVE-2021-22879
Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands
7.8
CVE-2024-37885
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer
7.8
CVE-2022-41882
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer
7.8
CVE-2020-8224
A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL config into a fixed directory