Medium severity · published Nov 15, 2024
CVE-2024-52509
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform
5.7
CVSS
0.5%
EPSS
No
On KEV
Description
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments. This allowed users to send them the files to themselves and then downloading it from their mail clients. It is recommended that the Nextcloud Mail is upgraded to 2.2.10, 3.6.2 or 3.7.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mail · Nextcloud
2.2.0 before 2.2.10; 3.6.0 before 3.6.2; 3.7.0 before 3.7.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-52509
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-52509
Patch
https://github.com/nextcloud/mail/commit/8d44f1ce44684022aa4e62a3e0462fdadcde6c8b
Patch
https://github.com/nextcloud/mail/pull/9592
Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pwpp-fvcr-w862
Issue Tracking
https://hackerone.com/reports/1878255
More from Mail
9.8
CVE-2023-48307
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform
9.8
CVE-2022-31132
Unauthenticated SSRF in 3rd party module "cerdic/csstidy"
8.1
CVE-2024-52508
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform
7.0
CVE-2020-8156
A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack
6.5
CVE-2023-23944
Nextcloud mail is an email app for the nextcloud home server platform