CVE-2024-52508: Nextcloud Mail auto configurator can be tricked into sending account information to wrong servers
First published: Fri Nov 15 2024(Updated: )
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. When a user is trying to set up a mail account with an email address like user@example.tld that does not support auto configuration, and an attacker managed to register autoconfig.tld, the used email details would be send to the server of the attacker. It is recommended that the Nextcloud Mail app is upgraded to 1.14.6, 1.15.4, 2.2.11, 3.6.3, 3.7.7 or 4.0.0.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nextcloud Mail | <1.14.6<1.15.4<2.2.11<3.6.3<3.7.7<4.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-52508?
CVE-2024-52508 has been rated as a medium-severity vulnerability.
How do I fix CVE-2024-52508?
To fix CVE-2024-52508, upgrade Nextcloud Mail to version 1.14.6, 1.15.4, 2.2.11, 3.6.3, 3.7.7, or later.
What versions are affected by CVE-2024-52508?
CVE-2024-52508 affects Nextcloud Mail versions prior to 1.14.6, 1.15.4, 2.2.11, 3.6.3, 3.7.7, and 4.0.0.
What causes CVE-2024-52508 vulnerability?
CVE-2024-52508 is caused by the improper handling of mail account setup when using domains that do not support auto configuration.
Can CVE-2024-52508 be exploited remotely?
Yes, CVE-2024-52508 can be exploited remotely if an attacker registers a domain that can be used for auto configuration.
- agent/weakness
- agent/references
- agent/title
- agent/description
- agent/first-publish-date
- agent/type
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/nextcloud
- canonical/nextcloud mail