Low severity · published Nov 15, 2024
CVE-2024-52514
Nextcloud Server allows users to copy folder that contain files that are blocked by the files access control
3.5
CVSS
0.5%
EPSS
No
On KEV
Description
Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files access control, the user would still be able to copy the intermediate folder inside Nextcloud allowing them to afterwards potentially access the blocked files depending on the user access control rules. It is recommended that the Nextcloud Server is upgraded to 27.1.9, 28.0.5 or 29.0.0 and Nextcloud Enterprise Server is upgraded to 21.0.9.18, 22.2.10.23, 23.0.12.18, 24.0.12.14, 25.0.13.9, 26.0.13.3, 27.1.9, 28.0.5 or 29.0.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
security-advisories · nextcloud
>= 28.0.0, < 28.0.5; >= 27.0.0, < 27.1.9 · source: vendor
NS
Nextcloud Server · Nextcloud
21.0.0 before 21.0.9.18; 22.0.0 before 22.2.10.23; 23.0.0 before 23.0.12.18; 24.0.0 before 24.0.12.14; 25.0.0 before 25.0.13.9; 26.0.0 before 26.0.13.3; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-52514
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-52514
Vendor Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g8pr-g25r-58xj
Patch
https://github.com/nextcloud/server/commit/5fffbcfe8650eab75b00e8d188fbc95b0e43f3a8
Issue Tracking
https://github.com/nextcloud/server/pull/44889
Issue Tracking
https://hackerone.com/reports/2447316
More from security-advisories
9.8
CVE-2022-31132
Unauthenticated SSRF in 3rd party module "cerdic/csstidy"
8.8
CVE-2026-45284
Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate
8.2
CVE-2026-45545
Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution
8.2
CVE-2024-52519
Nextcloud Server's OAuth2 client secrets were stored in a recoverable way
8.1
CVE-2026-45281
Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update