CVSS: 4.4EPSS: 0%CPEs: 3EXPL: 0CVE-2024-52518 – Nextcloud Server is missing password confirmation when changing external storage options
https://notcve.org/view.php?id=CVE-2024-52518
Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external storages without having to confirm the password. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vrhf-532w-99rg https://github.com/nextcloud/server/pull/48373 https://github.com/nextcloud/server/pull/48788 https://github.com/nextcloud/server/pull/48992 https://hackerone.com/reports/2602973 • CWE-287: Improper Authentication •
CVSS: 2.7EPSS: 0%CPEs: 2EXPL: 0CVE-2024-52519 – Nextcloud Server's OAuth2 client secrets were stored in a recoverable way
https://notcve.org/view.php?id=CVE-2024-52519
Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a backup of the database and the Nextcloud config file, would be able to decrypt them. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fvpc-8hq6-jgq2 https://github.com/nextcloud/server/commit/09b8aea8f6783514bffe00df6abbf9fa542faac5 https://github.com/nextcloud/server/pull/47635 • CWE-922: Insecure Storage of Sensitive Information •
CVSS: 5.7EPSS: 0%CPEs: 2EXPL: 0CVE-2024-52520 – Nextcloud Server's link reference provider can be tricked into downloading bigger files than intended
https://notcve.org/view.php?id=CVE-2024-52520
Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than intended, to find open-graph data. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pxqf-cfxw-mqmj https://github.com/nextcloud/server/commit/873c42b0f1383d5b6f2b7a481e1d9620ed30f44a https://github.com/nextcloud/server/pull/47627 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-400: Uncontrolled Resource Consumption •
CVSS: 2.6EPSS: 0%CPEs: 2EXPL: 0CVE-2024-52521 – Nextcloud Server has a potential hash collision for background jobs could skip queuing them
https://notcve.org/view.php?id=CVE-2024-52521
Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely being identified as already existing and not be queued for execution. By changing the Hash to SHA256 the probability was heavily decreased. It is recommended that the Nextcloud Server is upgraded to 28.0.10, 29.0.7 or 30.0.0. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2q6f-gjgj-7hp4 https://github.com/nextcloud/server/commit/a933ba1fdba77e7d8c6b8ff400e082cf853ea46d https://github.com/nextcloud/server/pull/47769 • CWE-328: Use of Weak Hash •
CVSS: 4.6EPSS: 0%CPEs: 3EXPL: 0CVE-2024-52523 – Nextcloud Server Custom defined credentials of external storages are sent back to the frontend
https://notcve.org/view.php?id=CVE-2024-52523
Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active session of a user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2 and Nextcloud Enterprise Server is upgraded to 25.0.13.14, 26.0.13.10, 27.1.11.10, 28.0.12, 29.0.9 or 30.0.2. • https://github.com/nextcloud/security-advisories/security/advisories/GHSA-42w6-r45m-9w9j https://github.com/nextcloud/server/commit/8a13f284765bd4606984e7d925c32ae6e82b8a27 https://github.com/nextcloud/server/pull/49009 • CWE-125: Out-of-bounds Read CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •