CVE-2024-52525: Nextcloud Server User password is available in memory of the PHP process
Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved in the session storage (Redis or disk), but it would allow a malicious process that gains access to the memory of the PHP process, to get access to the cleartext password of the user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52525?
CVE-2024-52525 is considered a high severity vulnerability due to the potential exposure of unencrypted user passwords in session data.
How do I fix CVE-2024-52525?
To fix CVE-2024-52525, update your Nextcloud Server to version 28.0.13, 29.0.10, or 30.0.3 or later.
What versions of Nextcloud Server are affected by CVE-2024-52525?
CVE-2024-52525 affects Nextcloud Server versions up to 28.0.12, 29.0.9, and 30.0.2.
What type of data is impacted by CVE-2024-52525?
CVE-2024-52525 impacts session data where user passwords could be stored unencrypted.
Is there a workaround for CVE-2024-52525?
There are no recommended workarounds for CVE-2024-52525; users should upgrade to a patched version.