CVE-2024-52523: Nextcloud Server Custom defined credentials of external storages are sent back to the frontend
First published: Fri Nov 15 2024(Updated: )
Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active session of a user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2 and Nextcloud Enterprise Server is upgraded to 25.0.13.14, 26.0.13.10, 27.1.11.10, 28.0.12, 29.0.9 or 30.0.2.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nextcloud Server | <28.0.12>=29.0.0<=29.0.8>=30.0.0<=30.0.1 | |
| Nextcloud Enterprise Server | <25.0.13.14>=26.0.0<=26.0.13.9>=27.0.0<=27.1.11.9<28.0.12>=29.0.0<=29.0.8>=30.0.0<=30.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-52523?
CVE-2024-52523 has a severity rating that indicates a risk of sensitive credential exposure.
How do I fix CVE-2024-52523?
To fix CVE-2024-52523, update the Nextcloud Server to versions 28.0.12 or higher and ensure to apply all recommended security configurations.
What type of data is exposed in CVE-2024-52523?
CVE-2024-52523 exposes external storage credentials in plain text to authenticated users.
Which versions of Nextcloud are affected by CVE-2024-52523?
CVE-2024-52523 affects Nextcloud Server versions up to 28.0.12 and specific ranges in versions 29 and 30.
Who is impacted by CVE-2024-52523?
Users and administrators of Nextcloud servers with configured external storage using fixed credentials are impacted by CVE-2024-52523.
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/weakness
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/nextcloud
- canonical/nextcloud server
- canonical/nextcloud enterprise server