https://bugzilla.suse.com/show_bug.cgi?id=1226371 Bug ID: 1226371 Summary: VUL-0: CVE-2024-37887: nextcloud: events information leaked with shared calendars on recurrence exceptions Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/411001/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: ecsos@schirra.net Reporter: smash_bz@suse.de QA Contact: security-team@suse.de CC: camila.matos@suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Nextcloud Server is a self hosted personal cloud system. Private shared calendar events' recurrence exceptions can be read by sharees. It is recommended that the Nextcloud Server is upgraded to 27.1.10 or 28.0.6 or 29.0.1 and that the Nextcloud Enterprise Server is upgraded to 27.1.10 or 28.0.6 or 29.0.1. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-37887 https://www.cve.org/CVERecord?id=CVE-2024-37887 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h4... https://github.com/nextcloud/server/pull/45309 https://hackerone.com/reports/2479325 -- You are receiving this mail because: You are on the CC list for the bug.