CVE-2024-52513: Nextcloud Server's Attachments folder for Text app is accessible on "Files drop" and "Password protected" shares
Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user was able to download attachments that are referenced in Text files without providing the password. It is recommended that the Nextcloud Server is upgraded to 28.0.11, 29.0.8 or 30.0.1 and Nextcloud Enterprise Server is upgraded to 25.0.13.13, 26.0.13.9, 27.1.11.9, 28.0.11, 29.0.8 or 30.0.1.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52513?
CVE-2024-52513 is considered a medium vulnerability due to unauthorized access to file attachments.
How do I fix CVE-2024-52513?
To fix CVE-2024-52513, upgrade your Nextcloud Server or Nextcloud Enterprise Server to the latest version recommended by the security advisories.
What versions of Nextcloud are affected by CVE-2024-52513?
CVE-2024-52513 affects Nextcloud Server versions up to 28.0.11 and Nextcloud Enterprise Server versions up to 30.0.1.
What specific issue does CVE-2024-52513 address in Nextcloud?
CVE-2024-52513 addresses a vulnerability where unauthorized users could download attachments referenced in text files without entering a password.
Is there a risk of data exposure with CVE-2024-52513?
Yes, CVE-2024-52513 poses a risk of data exposure as it allows malicious users to access files they should not have permission to download.