CVE-2024-46958 Misconfiguration in n/a
Attackers can read or modify synchronized files because the Nextcloud Desktop Client incorrectly sets world-writable or world-readable permissions on Linux.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-46958?
CVE-2024-46958 is a critical vulnerability in n/a, published on 16 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or world readable. This is fixed in 3.13.4.
Which versions are affected by CVE-2024-46958?
It affects 1 product.
Products include Nextcloud Desktop.
How do I fix CVE-2024-46958?
Upgrade to a fixed version.
Is CVE-2024-46958 being exploited?
There is no known exploitation of CVE-2024-46958 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2020-8224 Code injection in Desktop Client
- CVE-2020-8225 Information disclosure in Desktop Client
- CVE-2021-37617 Untrusted Search Path in Nextcloud Desktop Client
- CVE-2023-28999 Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders
- CVE-2020-8227 Path traversal in Desktop Client
Sources
Also known as DEBIAN-CVE-2024-46958, GHSA-gcwq-2mx4-wmcp, UBUNTU-CVE-2024-46958.