Home > Vulnerability Database > CVE-2024-46958

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2024-46958

Date: September 15, 2024

In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or world readable. This is fixed in 3.13.4.

Language: PHP

Severity Score

9.1

Related Resources (8)

Url: https://nvd.nist.gov/vuln/detail/CVE-2024-46958

Url: https://github.com/nextcloud/desktop/pull/7092

Url: https://github.com/nextcloud/desktop/issues/6863

Url: https://github.com/nextcloud/desktop/compare/v3.13.3...v3.13.4

Url: https://github.com/nextcloud/desktop/pull/6949

Url: https://github.com/nextcloud/security-advisories/security/advisories

Url: https://security-tracker.debian.org/tracker/CVE-2024-46958

Url: https://www.mend.io/vulnerability-database/CVE-2024-46958

Severity Score

9.1

Weakness Type (CWE)

Unrestricted Upload of File with Dangerous Type

CWE-434

CVSS v3.1

Base Score:	9.1
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	NONE

Do you need more information?

Contact Us