CVE-2024-52518: Nextcloud Server is missing password confirmation when changing external storage options
First published: Fri Nov 15 2024(Updated: )
Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external storages without having to confirm the password. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nextcloud Server | <28.0.12<29.0.9<30.0.2 | |
| Nextcloud Server | >=28.0.0<28.0.12 | |
| Nextcloud Server | >=28.0.0<28.0.12 | |
| Nextcloud Server | >=29.0.0<29.0.9 | |
| Nextcloud Server | >=29.0.0<29.0.9 | |
| Nextcloud Server | >=30.0.0<30.0.2 | |
| Nextcloud Server | >=30.0.0<30.0.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-52518?
CVE-2024-52518 is classified as a high severity security vulnerability affecting Nextcloud Server.
How do I fix CVE-2024-52518?
To fix CVE-2024-52518, upgrade your Nextcloud Server to the latest version beyond the affected versions listed.
What versions of Nextcloud Server are affected by CVE-2024-52518?
CVE-2024-52518 affects Nextcloud Server versions up to 28.0.12, 29.0.9, and 30.0.2.
What can an attacker do if they exploit CVE-2024-52518?
An attacker who exploits CVE-2024-52518 can create, change, or delete external storage without user confirmation.
How does CVE-2024-52518 impact users of Nextcloud Server?
CVE-2024-52518 compromises user sessions, putting sensitive data at risk by allowing unauthorized external storage access.
- agent/references
- agent/title
- agent/description
- agent/first-publish-date
- agent/type
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup-request
- vendor/nextcloud
- canonical/nextcloud server
- version/nextcloud server/28.0.0
- version/nextcloud server/29.0.0
- version/nextcloud server/30.0.0