CVE-2024-52514: Nextcloud Server allows users to copy folder that contain files that are blocked by the files access control
First published: Fri Nov 15 2024(Updated: )
Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files access control, the user would still be able to copy the intermediate folder inside Nextcloud allowing them to afterwards potentially access the blocked files depending on the user access control rules. It is recommended that the Nextcloud Server is upgraded to 27.1.9, 28.0.5 or 29.0.0 and Nextcloud Enterprise Server is upgraded to 21.0.9.18, 22.2.10.23, 23.0.12.18, 24.0.12.14, 25.0.13.9, 26.0.13.3, 27.1.9, 28.0.5 or 29.0.0.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nextcloud Server | >=27.1.9<=29.0.0 | |
| Nextcloud Enterprise Server | >=21.0.9.18<=21.0.9.18>=22.2.10.23<=22.2.10.23>=23.0.12.18<=23.0.12.18>=24.0.12.14<=24.0.12.14>=25.0.13.9<=25.0.13.9>=26.0.13.3<=26.0.13.3>=27.1.9<=29.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-52514?
The severity of CVE-2024-52514 is not explicitly rated, but it allows unauthorized access to shared files in Nextcloud under certain conditions.
How do I fix CVE-2024-52514?
To mitigate CVE-2024-52514, users should update to the fixed versions of Nextcloud Server and Nextcloud Enterprise Server as specified in the vendor's advisory.
What versions are affected by CVE-2024-52514?
CVE-2024-52514 affects Nextcloud Server versions 27.1.9 to 29.0.0 and several specific versions of Nextcloud Enterprise Server.
What type of vulnerability is CVE-2024-52514?
CVE-2024-52514 is an access control vulnerability that allows users to bypass file sharing restrictions.
Who is impacted by CVE-2024-52514?
Users of Nextcloud Server and Nextcloud Enterprise Server with specific versions may be impacted by CVE-2024-52514.
- agent/weakness
- agent/references
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/nextcloud
- canonical/nextcloud server
- canonical/nextcloud enterprise server