CVE-2024-52514: Nextcloud Server is a self hosted personal cloud system

Low severity · published Nov 15, 2024

CVE-2024-52514

Nextcloud Server is a self hosted personal cloud system

3.5

CVSS

0.5%

EPSS

On KEV

Description

Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files access control, the user would still be able to copy the intermediate folder inside Nextcloud allowing them to afterwards potentially access the blocked files depending on the user access control rules. It is recommended that the Nextcloud Server is upgraded to 27.1.9, 28.0.5 or 29.0.0 and Nextcloud Enterprise Server is upgraded to 21.0.9.18, 22.2.10.23, 23.0.12.18, 24.0.12.14, 25.0.13.9, 26.0.13.3, 27.1.9, 28.0.5 or 29.0.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

Required

Confidentiality

Low

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.5% · higher than 44% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Nextcloud Server · Nextcloud

21.0.0 before 21.0.9.18; 22.0.0 before 22.2.10.23; 23.0.0 before 23.0.12.18; 24.0.0 before 24.0.12.14; 25.0.0 before 25.0.13.9; 26.0.0 before 26.0.13.3; +4 more · source: NVD

Affected product

Nextcloud Server

Nextcloud

All Nextcloud Server CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-52514

CVE.org

https://www.cve.org/CVERecord?id=CVE-2024-52514

Vendor Advisory

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g8pr-g25r-58xj

Patch

https://github.com/nextcloud/server/commit/5fffbcfe8650eab75b00e8d188fbc95b0e43f3a8

Issue Tracking

https://github.com/nextcloud/server/pull/44889

Issue Tracking

https://hackerone.com/reports/2447316