CVE-2024-52525: Nextcloud Server User password is available in memory of the PHP process
First published: Fri Nov 15 2024(Updated: )
Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved in the session storage (Redis or disk), but it would allow a malicious process that gains access to the memory of the PHP process, to get access to the cleartext password of the user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nextcloud Server | <28.0.12<29.0.9<30.0.2 | |
| Nextcloud Server | >=28.0.0<28.0.12 | |
| Nextcloud Server | >=28.0.0<28.0.12 | |
| Nextcloud Server | >=29.0.0<29.0.9 | |
| Nextcloud Server | >=29.0.0<29.0.9 | |
| Nextcloud Server | >=30.0.0<30.0.2 | |
| Nextcloud Server | >=30.0.0<30.0.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-52525?
CVE-2024-52525 is considered a high severity vulnerability due to the potential exposure of unencrypted user passwords in session data.
How do I fix CVE-2024-52525?
To fix CVE-2024-52525, update your Nextcloud Server to version 28.0.13, 29.0.10, or 30.0.3 or later.
What versions of Nextcloud Server are affected by CVE-2024-52525?
CVE-2024-52525 affects Nextcloud Server versions up to 28.0.12, 29.0.9, and 30.0.2.
What type of data is impacted by CVE-2024-52525?
CVE-2024-52525 impacts session data where user passwords could be stored unencrypted.
Is there a workaround for CVE-2024-52525?
There are no recommended workarounds for CVE-2024-52525; users should upgrade to a patched version.
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/severity
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- vendor/nextcloud
- canonical/nextcloud server
- version/nextcloud server/28.0.0
- version/nextcloud server/29.0.0
- version/nextcloud server/30.0.0