Likely permanent: GitHub doesn’t review this ecosystem

GHSA-3m2f-v8x7-9w99

Server on nextcloud · published in nextcloud/security-advisories

Fixed in 24.0.11, 25.0.5. Dependabot, npm audit and OSV-Scanner probably never will. Find it in your project

Facts

Severity: Medium · CVSS score 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Affected versions (Server): >= 24.0.0, >= 25.0.0As entered by the maintainer. Not reviewed. Scanners can’t read this range. How to fix it
Fixed in (Server): 24.0.11, 25.0.5
Affected versions (Server): >= 21.0.0, >= 22.0.0, >= 23.0.0, >= 24.0.0, >= 25.0.0As entered by the maintainer. Not reviewed. Scanners can’t read this range. How to fix it
Fixed in (Server): 21.0.9.11, 22.2.10.11, 23.0.12.6, 24.0.11, 25.0.5
Affected versions (Files automated tagging): >= 1.11.0, >= 1.12.0, >= 1.13.0, >= 1.14.0, >= 1.15.0, >= 1.16.0As entered by the maintainer. Not reviewed. Scanners can’t read this range. How to fix it
Fixed in (Files automated tagging): 1.11.1, 1.12.1, 1.13.1, 1.14.2, 1.15.3, 1.16.1
CVE: CVE-2023-30539 · published
GitHub Advisory Database: Not reviewed
OSV.dev: Not present
Other CVEs pointing here: None found in the CVE List

Upgrade to the fixed version for your release line: 24.0.11, 25.0.5. Dependabot, npm audit and OSV-Scanner probably never will.