Vulnerability · Published Nov 15, 2024 · Assigned by GitHub_M
CVE-2024-52518Nextcloud Server is missing password confirmation when changing external storage options
Medium 4.4
In plain English
A medium-severity improper authentication in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Severity (CVSS 3.1)4.4Medium
Exploit odds (30 days)0.5%top 54.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external storages without having to confirm the password. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nextcloud | security-advisories | >= 28.0.0, < 28.0.12>= 29.0.0, < 29.0.9>= 30.0.0, < 30.0.2 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vrhf-532w-99rg x_refsource_CONFIRM
- https://github.com/nextcloud/server/pull/48373 x_refsource_MISC
- https://github.com/nextcloud/server/pull/48788 x_refsource_MISC
- https://github.com/nextcloud/server/pull/48992 x_refsource_MISC
- https://hackerone.com/reports/2602973 x_refsource_MISC