Information disclosure in Nextcloud Server and Enterprise Server



Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2024-52523
CWE-ID CWE-200
Exploitation vector Local
Public exploit N/A
Vulnerable software
 Nextcloud Server
Client/Desktop applications / Messaging software

Nextcloud Enterprise Server
Client/Desktop applications / Messaging software

Vendor Nextcloud

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Information disclosure

EUVDB-ID: #VU103056

Risk: Low

CVSSv4.0: 0.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-52523

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to custom defined credentials of external storages are sent back to the frontend. An administrator with physical access can gain unauthorized access to sensitive information on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Nextcloud Server: 28.0.0 - 30.0.1

Nextcloud Enterprise Server: 25.0.0 - 30.0.1

CPE2.3 External links

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-42w6-r45m-9w9j
https://github.com/nextcloud/server/pull/49009
https://github.com/nextcloud/server/commit/8a13f284765bd4606984e7d925c32ae6e82b8a27


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###