Report feedback

Allows an unauthenticated remote attacker to access sensitive data in Nextcloud Mail by impersonating the victim's autoconfiguration server, which may lead to takeover of the victim's e-mail account [1]

The vulnerability is present in product:

• Nextcloud Mail; >= 1.9.0, < 1.14.6; >= 2.1.0, < 2.2.11; >= 3.1.0, < 3.6.3; >= 1.15.0, < 1.15.4; >= 3.7.0, < 3.7.7;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L

More information:

• CVE-2024-52508 at cve.org, NVD
• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor at cwe.mitre.org

The vulnerability was publicly disclosed 15. 11. 2024.

Allows an authenticated remote attacker to add rows to tables in Nextcloud Tables that they are not authorized to access [6].

The vulnerability is present in product:

• Nextcloud Tables; >= 0.6.0, < 0.8.0;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N

More information:

• CVE-2024-52511 at cve.org, NVD
• CWE-639: Authorization Bypass Through User-Controlled Key at cwe.mitre.org

The vulnerability was publicly disclosed 15. 11. 2024.

Allows an authenticated remote attacker, by uploading a specially crafted SVG file, to view previews of SVG files for which they lack the appropriate permissions in Nextcloud (Enterprise) Server [7].

The vulnerability is present in product:

• Nextcloud Server; >= 29.0.0, < 29.0.1; >= 28.0.0, < 28.0.6; >= 27.0.0, < 27.1.10;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

More information:

• CVE-2024-52515 at cve.org, NVD
• CWE-706: Use of Incorrectly-Resolved Name or Reference at cwe.mitre.org

The vulnerability was publicly disclosed 15. 11. 2024.

Allows an authenticated remote attacker to perform a DoS attack in Nextcloud (Enterprise) Server by creating a preview of a specially crafted web page [8].

The vulnerability is present in products:

• Nextloud Server; >= 28.0.0, < 28.0.10; >= 29.0.0, < 29.0.7;
• Nextloud Enterprise Server; >= 27.0.0, < 27.1.11.8; >= 28.0.0, < 28.0.10; >= 29.0.0, < 29.0.7;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

More information:

• CVE-2024-52520 at cve.org, NVD
• CWE-400: Uncontrolled Resource Consumption at cwe.mitre.org

The vulnerability was publicly disclosed 15. 11. 2024.

Allows an authenticated remote attacker to bypass signature validation in Nextcloud Desktop Client by sending a specially crafted request from Nextcloud Server [4].

The vulnerability is present in product:

• Nextcloud Desktop Client; >= 3.0.0, < 3.14.2;

CVSS: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

More information:

• CVE-2024-52510 at cve.org, NVD
• CWE-295: Improper Certificate Validation at cwe.mitre.org

The vulnerability was publicly disclosed 15. 11. 2024.

Allows an unauthenticated remote attacker, using social engineering, to trick a victim into opening a URL in Nextcloud User OIDC that redirects them, after logging in to Nextcloud OIDC, to a web page controlled by the attacker [5].

The vulnerability is present in product:

• Nextcloud User OIDC; >= 6.0.0, < 6.1.0;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

More information:

• CVE-2024-52512 at cve.org, NVD
• CWE-601: URL Redirection to Untrusted Site ('Open Redirect') at cwe.mitre.org

The vulnerability was publicly disclosed 15. 11. 2024.