CVE-2021-37617

    Dashboard / Vulnerabilities / CVE-2021-37617

    CVE-2021-37617

    Published: 18 Aug 2021Last Modified: 9 Jul 2026

    Summary:

    Details: The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. The Nextcloud Desktop Client invokes its uninstaller script when being installed to make sure there are no remnants of previous installations. In versions 3.0.3 through 3.2.4, the Client searches the `Uninstall.exe` file in a folder that can be written by regular users. This could lead to a case where a malicious user creates a malicious `Uninstall.exe`, which would be executed with administrative privileges on the Nextcloud Desktop Client installation. This issue is fixed in Nextcloud Desktop Client version 3.3.0. As a workaround, do not allow untrusted users to create content in the `C:\` system folder and verify that there is no malicious `C:\Uninstall.exe` file on the system.

    References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6q2w-v879-q24v, https://hackerone.com/reports/1240749, https://github.com/nextcloud/desktop/pull/3497

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 78da725ac38e1508e5800d02fd1700a4e43b1088
    Fixed -acf3bf0959fc83393b71fbeed5b7633cab0f0d9d

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-37617 | CVE-DB