CVE-2024-52513
- Source
- https://cve.org/CVERecord?id=CVE-2024-52513
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-52513.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-52513
- Aliases
-
- GHSA-gxph-5m4j-pfmj
- Published
- 2024-11-15T17:08:56.019Z
- Modified
- 2026-03-09T23:58:24.823103Z
- Severity
-
- 2.6 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- Nextcloud Server's Attachments folder for Text app is accessible on "Files drop" and "Password protected" shares
- Details
-
Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user was able to download attachments that are referenced in Text files without providing the password. It is recommended that the Nextcloud Server is upgraded to 28.0.11, 29.0.8 or 30.0.1 and Nextcloud Enterprise Server is upgraded to 25.0.13.13, 26.0.13.9, 27.1.11.9, 28.0.11, 29.0.8 or 30.0.1.
- Database specific
{ "cwe_ids": [ "CWE-200" ], "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52513.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52513.json
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gxph-5m4j-pfmj
- https://github.com/nextcloud/text/commit/ca24b25c93b81626b4e457c260243edeab5f1548
- https://github.com/nextcloud/text/pull/6485
- https://hackerone.com/reports/2376900
- https://nvd.nist.gov/vuln/detail/CVE-2024-52513
Affected packages
Git / github.com/nextcloud/server
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nextcloud/server
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixed
- Database specific
{ "versions": [ { "introduced": "28.0.0" }, { "fixed": "28.0.11" }, { "introduced": "28.0.0" }, { "fixed": "28.0.11" }, { "introduced": "29.0.0" }, { "fixed": "29.0.8" }, { "introduced": "29.0.0" }, { "fixed": "29.0.8" }, { "introduced": "30.0.0" }, { "fixed": "30.0.1" }, { "introduced": "30.0.0" }, { "fixed": "30.0.1" } ] }
Affected versions
v28.*
v28.0.0
v28.0.1
v28.0.10
v28.0.10rc1
v28.0.11rc1
v28.0.1rc1
v28.0.2
v28.0.2rc1
v28.0.2rc2
v28.0.2rc3
v28.0.2rc4
v28.0.2rc5
v28.0.3
v28.0.3rc1
v28.0.3rc2
v28.0.4
v28.0.4rc1
v28.0.5
v28.0.5rc1
v28.0.6
v28.0.6rc1
v28.0.7
v28.0.7rc1
v28.0.7rc2
v28.0.7rc3
v28.0.7rc4
v28.0.8
v28.0.8rc1
v28.0.9
v28.0.9rc1
v29.*
v29.0.0
v29.0.1
v29.0.1rc1
v29.0.2
v29.0.2rc1
v29.0.2rc2
v29.0.3
v29.0.3rc1
v29.0.3rc2
v29.0.3rc3
v29.0.3rc4
v29.0.4
v29.0.4rc1
v29.0.5
v29.0.5rc1
v29.0.6
v29.0.6rc1
v29.0.7
v29.0.7rc1
v29.0.8rc1
v30.*
v30.0.0
v30.0.1rc1
v30.0.1rc2
Git / github.com/nextcloud/text
Affected ranges
Affected versions
v28.*
v28.0.0
v28.0.1
v28.0.10
v28.0.10rc1
v28.0.11rc1
v28.0.1rc1
v28.0.2
v28.0.2rc1
v28.0.2rc2
v28.0.2rc3
v28.0.2rc4
v28.0.2rc5
v28.0.3
v28.0.3rc1
v28.0.3rc2
v28.0.4
v28.0.4rc1
v28.0.5
v28.0.5rc1
v28.0.6
v28.0.6rc1
v28.0.7
v28.0.7rc1
v28.0.7rc2
v28.0.7rc3
v28.0.7rc4
v28.0.8
v28.0.8rc1
v28.0.9
v28.0.9rc1
v29.*
v29.0.0
v29.0.1
v29.0.1rc1
v29.0.2
v29.0.2rc1
v29.0.2rc2
v29.0.3
v29.0.3rc1
v29.0.3rc2
v29.0.3rc3
v29.0.3rc4
v29.0.4
v29.0.4rc1
v29.0.5
v29.0.5rc1
v29.0.6
v29.0.6rc1
v29.0.7
v29.0.7rc1
v29.0.8rc1
v30.*
v30.0.0
v30.0.0rc5
v30.0.1rc1
v30.0.1rc2