CVE-2024-52514

MEDIUM

Nextcloud Server < 21.0.9.18 - Improper Access Control

Title source: rule
STIX 2.1

Description

Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files access control, the user would still be able to copy the intermediate folder inside Nextcloud allowing them to afterwards potentially access the blocked files depending on the user access control rules. It is recommended that the Nextcloud Server is upgraded to 27.1.9, 28.0.5 or 29.0.0 and Nextcloud Enterprise Server is upgraded to 21.0.9.18, 22.2.10.23, 23.0.12.18, 24.0.12.14, 25.0.13.9, 26.0.13.3, 27.1.9, 28.0.5 or 29.0.0.

References (4)

Core 4

Scores

CVSS v3 4.1
EPSS 0.0032
EPSS Percentile 55.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-284
Status published
Products (2)
nextcloud/nextcloud_server 21.0.0 - 21.0.9.18
nextcloud/nextcloud_server 27.0.0 - 27.1.9
Published Nov 15, 2024
Tracked Since Feb 18, 2026