CVE-2024-37883: nextcloud deck

csirt@kutim:~/threat-intel/cve/CVE-2024-37883

CVSS 4.3 · Medium EPSS 0,38%

Kerentanan Improper Access Control pada nextcloud deck. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A user with access to a deck board was able to access comments and attachments of already deleted cards. It is recommended that the Nextcloud Deck app is upgraded to 1.6.6 or 1.7.5 or 1.8.7 or 1.9.6 or 1.11.3 or 1.12.1.

Rincian

Terbit di NVD: 14 Juni 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-284: Improper Access Control
EPSS (30 hari): 0,38% peluang dieksploitasi; lebih tinggi dari 30,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
nextcloud	deck	Versi 1.6.0 hingga sebelum 1.6.6
nextcloud	deck	Versi 1.7.0 hingga sebelum 1.7.5
nextcloud	deck	Versi 1.8.0 hingga sebelum 1.8.7
nextcloud	deck	Versi 1.9.0 hingga sebelum 1.9.6
nextcloud	deck	Versi 1.11.0 hingga sebelum 1.11.3
nextcloud	deck	Versi 1.12.0
nextcloud	deck	Versi 1.12.0 beta1
nextcloud	deck	Versi 1.12.0 beta2
nextcloud	deck	Versi 1.12.0 beta3
nextcloud	deck	Versi 1.12.0 beta4
nextcloud	deck	Versi 1.12.0 beta5

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/nextcloud/deck/pull/5423 patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x45g-vx69-r9m8 patch · advisory pihak ketiga
https://hackerone.com/reports/2289333 issue tracking

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.