CVE-2024-52510: Nextcloud Desktop client behaves incorrectly if the initial end-to-end-encryption signature is empty
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed by-passing the signature validation, if a manipulated server sends an empty initial signature. It is recommended that the Nextcloud Desktop client is upgraded to 3.14.2 or later.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52510?
CVE-2024-52510 is classified as a medium severity vulnerability that allows bypassing signature validation in the Nextcloud Desktop Client.
How do I fix CVE-2024-52510?
To fix CVE-2024-52510, upgrade to Nextcloud Desktop Client version 3.14.3 or later, which addresses this vulnerability.
Who is affected by CVE-2024-52510?
CVE-2024-52510 affects users of the Nextcloud Desktop Client version up to 3.14.2.
What is the impact of CVE-2024-52510?
The impact of CVE-2024-52510 is the potential for unauthorized access to files due to bypassed signature validation.
When was CVE-2024-52510 disclosed?
CVE-2024-52510 was disclosed in the security advisories for Nextcloud and has been addressed in updates released thereafter.