CVE-2024-52518: Nextcloud Server is missing password confirmation when changing external storage options
Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external storages without having to confirm the password. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52518?
CVE-2024-52518 is classified as a high severity security vulnerability affecting Nextcloud Server.
How do I fix CVE-2024-52518?
To fix CVE-2024-52518, upgrade your Nextcloud Server to the latest version beyond the affected versions listed.
What versions of Nextcloud Server are affected by CVE-2024-52518?
CVE-2024-52518 affects Nextcloud Server versions up to 28.0.12, 29.0.9, and 30.0.2.
What can an attacker do if they exploit CVE-2024-52518?
An attacker who exploits CVE-2024-52518 can create, change, or delete external storage without user confirmation.
How does CVE-2024-52518 impact users of Nextcloud Server?
CVE-2024-52518 compromises user sessions, putting sensitive data at risk by allowing unauthorized external storage access.