CVE-2024-52519

HIGH EPSS 38.5%
Published Nov 15, 20241y ago · Modified Jun 17, 20262w ago
8.2 CVSS 3.1
High
Find Similar
Published Nov 15, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a backup of the database and the Nextcloud config file, would be able to decrypt them. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7.

CVSS Details

Base Score
8.2
Exploitability
3.9
Impact
4.2
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
38.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-922

Affected Products 5

VendorProductVersionRange
nextcloudnextcloud_server*≥27.0.0  –  <27.1.11.8
nextcloudnextcloud_server*≥28.0.0  –  <28.0.10
nextcloudnextcloud_server*≥28.0.0  –  <28.0.10
nextcloudnextcloud_server*≥29.0.0  –  <29.0.7
nextcloudnextcloud_server*≥29.0.0  –  <29.0.7

References 3

  • github.com https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fvpc-8hq6-jgq2
    Vendor Advisory
  • github.com https://github.com/nextcloud/server/commit/09b8aea8f6783514bffe00df6abbf9fa542faac5
    Patch
  • github.com https://github.com/nextcloud/server/pull/47635
    Issue Tracking

Remediation

  • github.com https://github.com/nextcloud/server/commit/09b8aea8f6783514bffe00df6abbf9fa542faac5
    Patch