CVE-2024-37317

CVE-2024-37317 describes a vulnerability in the Nextcloud Notes app where an attacker could manipulate the storage location for a new user's personal notes. By sharing a folder named "Notes/" with a newly created user before their initial login, an attacker could redirect the Notes app to use this controlled folder. This medium-severity vulnerability (CVSS 4.6) has a low attack complexity and requires user interaction, potentially leading to limited confidentiality and integrity impacts on the affected user's notes. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.