CVE-2024-52523: Nextcloud Server Custom defined credentials of external storages are sent back to the frontend

Medium severity · published Nov 15, 2024

CVE-2024-52523

Nextcloud Server Custom defined credentials of external storages are sent back to the frontend

6.5

CVSS

0.7%

EPSS

On KEV

Description

Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active session of a user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2 and Nextcloud Enterprise Server is upgraded to 25.0.13.14, 26.0.13.10, 27.1.11.10, 28.0.12, 29.0.9 or 30.0.2.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.7% · higher than 52% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

security-advisories · nextcloud

>= 28.0.0, < 28.0.12; >= 29.0.0, < 29.0.9; >= 30.0.0, < 30.0.2 · source: vendor

Nextcloud Server · Nextcloud

25.0.0 before 25.0.13.14; 26.0.0 before 26.0.13.10; 27.0.0 before 27.1.11.10; 28.0.0 before 28.0.12; 28.0.0 before 28.0.12; 29.0.0 before 29.0.9; +3 more · source: NVD

Affected product

security-advisories

nextcloud

All security-advisories CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-52523

CVE.org

https://www.cve.org/CVERecord?id=CVE-2024-52523

Vendor Advisory

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-42w6-r45m-9w9j

Patch

https://github.com/nextcloud/server/commit/8a13f284765bd4606984e7d925c32ae6e82b8a27

Issue Tracking

https://github.com/nextcloud/server/pull/49009