High severity · published Nov 15, 2024
CVE-2024-52508
Nextcloud Mail auto configurator can be tricked into sending account information to wrong servers
8.1
CVSS
0.8%
EPSS
No
On KEV
Description
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. When a user is trying to set up a mail account with an email address like user@example.tld that does not support auto configuration, and an attacker managed to register autoconfig.tld, the used email details would be send to the server of the attacker. It is recommended that the Nextcloud Mail app is upgraded to 1.14.6, 1.15.4, 2.2.11, 3.6.3, 3.7.7 or 4.0.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
security-advisories · nextcloud
>= 1.9.0, < 1.14.6; >= 2.1.0, < 2.2.11; >= 3.1.0, < 3.6.3; >= 1.15.0, < 1.15.4; >= 3.7.0, < 3.7.7 · source: vendor
MA
Mail · Nextcloud
1.9.0 before 1.14.6; 1.15.0 before 1.15.4; 2.1.0 before 2.2.11; 3.1.0 before 3.6.3; 3.7.0 before 3.7.7 · source: NVD
NM
Nextcloud Mail · Nextcloud
1.9.0 before 1.14.6; 2.1.0 before 2.2.11; 3.1.0 before 3.6.3; 1.15.0 before 15.4.0; 3.7.0 before 3.7.7 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-52508
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-52508
Patch
https://github.com/nextcloud/mail/commit/a84c70e15d814dab6f0e8eda71bbaaf48152079b
Issue Tracking
https://github.com/nextcloud/mail/pull/9964
Vendor Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vmhx-hwph-q6mc
Issue Tracking
https://hackerone.com/reports/2508422
More from security-advisories
9.8
CVE-2022-31132
Unauthenticated SSRF in 3rd party module "cerdic/csstidy"
8.8
CVE-2026-45284
Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate
8.2
CVE-2026-45545
Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution
8.2
CVE-2024-52519
Nextcloud Server's OAuth2 client secrets were stored in a recoverable way
8.1
CVE-2026-45281
Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update