SB2025012096 - Multiple vulnerabilities in Nextcloud Server and Enterprise Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025012096

SB2025012096 - Multiple vulnerabilities in Nextcloud Server and Enterprise Server

Published: January 20, 2025

Security Bulletin ID SB2025012096
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Improper Authentication (CVE-ID: CVE-2024-52518)

The vulnerability allows a remote user to bypass authentication process.

The vulnerability exists due to missing password confirmation when changing external storage options. A remote administrator can bypass authentication process and gain access to the session of a user or administrator.


2) Cleartext storage of sensitive information (CVE-ID: CVE-2024-52525)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to the user password is available in memory of the PHP process. An administrator with physical access can gain access sensitive information on the target system.


Remediation

Install update from vendor's website.

References