CVE-2024-52509: Nextcloud Mail app does not respect download permissions in shares

Description

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments. This allowed users to send them the files to themselves and then downloading it from their mail clients. It is recommended that the Nextcloud Mail is upgraded to 2.2.10, 3.6.2 or 3.7.2.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

Required

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.5% · higher than 45% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

SE

security-advisories · nextcloud

>=2.2.0, < 2.2.10; >= 3.6.0, < 3.6.2; >= 3.7.0, < 3.7.2 · source: vendor

MA

Mail · Nextcloud

2.2.0 before 2.2.10; 3.6.0 before 3.6.2; 3.7.0 before 3.7.2 · source: NVD