DeutschShown in its original language — a full translation is planned for a future version.
Nextcloud: Mehrere Schwachstellen
view advisory published 2024-11-17
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Nextcloud ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu erzeugen oder Daten zu manipulieren.
01
describes (18)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-52514US | low3.5 | — | ||
Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files access control, the user would still be abl… | ||||
| CVE-2024-52513US | medium4.3 | — | ||
Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user was able to download attachments that ar… | ||||
| CVE-2024-52512US | medium6.1 | — | ||
user_oidc app is an OpenID Connect user backend for Nextcloud. A malicious user could send a malformed login link that would redirect the user to a provided URL after successfully… | ||||
| CVE-2024-52511US | medium6.5 | — | ||
Nextcloud Tables allows users to to create tables with individual columns. By directly specifying the ID of a table or view, a malicious user could blindly insert new rows into tab… | ||||
| CVE-2024-52510US | high7.5 | Exploit | ||
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed by-passing the signa… | ||||
| CVE-2024-52509US | medium5.7 | — | ||
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as… | ||||
| CVE-2024-52508US | high8.1 | — | ||
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. When a user is trying to set up a mail account with an email address like user@example.tld that d… | ||||
| CVE-2024-52507US | medium4.3 | — | ||
Nextcloud Tables allows users to to create tables with individual columns. The information which Table (numeric ID) is shared with which groups and users and the respective permiss… | ||||
| CVE-2024-52525US | high7.5OT elevated | — | ||
Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted b… | ||||
| CVE-2024-52523US | medium6.5 | — | ||
Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds the… | ||||
| CVE-2024-52521US | medium5.3 | — | ||
Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arg… | ||||
| CVE-2024-52520US | medium6.5 | — | ||
Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than inte… | ||||
| CVE-2024-52519US | high8.2 | — | ||
Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a backup of the database… | ||||
| CVE-2024-52518US | medium5.4OT elevated | — | ||
Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or del… | ||||
| CVE-2024-52517US | medium5.9 | — | ||
Nextcloud Server is a self hosted personal cloud system. After storing "Global credentials" on the server, the API returns them and adds them into the frontend again, allowing to r… | ||||
| CVE-2024-52516US | medium4.3 | — | ||
Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own groups, after a user was removed from a g… | ||||
| CVE-2024-52515US | medium6.5 | — | ||
Nextcloud Server is a self hosted personal cloud system. After an admin enables the default-disabled SVG preview provider, a malicious user could upload a manipulated SVG file refe… | ||||
| CVE-2024-46958US | critical9.1OT elevated | — | ||
In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or world readable. This is fixed in 3.13.4. | ||||
02
references
External citations — patches, advisories, analysis.
- NextCloud Security Advisories vom 2024-11-17external
- NextCloud Security Advisories vom 2024-11-17external
- NextCloud Security Advisories vom 2024-11-17external
- NextCloud Security Advisories vom 2024-11-17external
- NextCloud Security Advisories vom 2024-11-17external
- NextCloud Security Advisories vom 2024-11-17external
- NextCloud Security Advisories vom 2024-11-17external
- NextCloud Security Advisories vom 2024-11-17external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan