CVE-2024-37885

low-risk
Published 2024-06-14

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop Client for macOS allowed to load arbitrary code when starting the client with DYLD_INSERT_LIBRARIES set in the enviroment. It is recommended that the Nextcloud Desktop client is upgraded to 3.12.0.

Do I need to act?

-
0.13% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.8/10 Low
LOCAL / HIGH complexity

Affected Products (1)

Affected Vendors

Nextcloud

References (6)

Patch https://github.com/nextcloud/desktop/pull/6378
Patch https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4mf7-v...
Issue Tracking https://hackerone.com/reports/2307625
Patch https://github.com/nextcloud/desktop/pull/6378
Patch https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4mf7-v...
Issue Tracking https://hackerone.com/reports/2307625
16
/ 100
low-risk
Severity 10/34 · Low
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal