CVE-2024-52515: Nextcloud Server is a self hosted personal cloud system

Medium severity · published Nov 15, 2024

CVE-2024-52515

Nextcloud Server is a self hosted personal cloud system

6.5

CVSS

0.7%

EPSS

On KEV

Description

Nextcloud Server is a self hosted personal cloud system. After an admin enables the default-disabled SVG preview provider, a malicious user could upload a manipulated SVG file referencing paths. If the file would exist the preview of the SVG would preview the other file instead. It is recommended that the Nextcloud Server is upgraded to 27.1.10, 28.0.6 or 29.0.1 and Nextcloud Enterprise Server is upgraded to 24.0.12.15, 25.0.13.10, 26.0.13.4, 27.1.10, 28.0.6 or 29.0.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.7% · higher than 53% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Nextcloud Server · Nextcloud

24.0.0 before 24.0.12.15; 25.0.0 before 25.0.13.10; 26.0.0 before 26.0.13.4; 27.0.0 before 27.1.10; 27.0.0 before 27.1.10; 28.0.0 before 28.0.6; +3 more · source: NVD

Affected product

Nextcloud Server

Nextcloud

All Nextcloud Server CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-52515

CVE.org

https://www.cve.org/CVERecord?id=CVE-2024-52515

Vendor Advisory

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5m5g-hw8c-2236

Patch

https://github.com/nextcloud/server/commit/7e1c30f82a63fbea8c269e0eec38291377f32604

Issue Tracking

https://github.com/nextcloud/server/pull/45340

Issue Tracking

https://hackerone.com/reports/2484499