Vulnerability · Published Nov 15, 2024 · Assigned by GitHub_M

CVE-2024-52509Nextcloud Mail app does not respect download permissions in shares

Low 3.5

In plain English

A low-severity improper access control in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.5%top 54.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments. This allowed users to send them the files to themselves and then downloading it from their mail clients. It is recommended that the Nextcloud Mail is upgraded to 2.2.10, 3.6.2 or 3.7.2.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	>=2.2.0, < 2.2.10>= 3.6.0, < 3.6.2>= 3.7.0, < 3.7.2

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pwpp-fvcr-w862 x_refsource_CONFIRM
https://github.com/nextcloud/mail/pull/9592 x_refsource_MISC
https://github.com/nextcloud/mail/commit/8d44f1ce44684022aa4e62a3e0462fdadcde6c8b x_refsource_MISC
https://hackerone.com/reports/1878255 x_refsource_MISC