Vulnerability Description
Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved in the session storage (Redis or disk), but it would allow a malicious process that gains access to the memory of the PHP process, to get access to the cleartext password of the user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nextcloud | Nextcloud Server | >= 28.0.0, < 28.0.12 |
Related Weaknesses (CWE)
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w7v5-mVendor Advisory
- https://github.com/nextcloud/server/commit/d25a0a2896a2a981939cacb8ee0d555feef22Patch
- https://github.com/nextcloud/server/pull/48915Issue Tracking
FAQ
What is CVE-2024-52525?
CVE-2024-52525 is a vulnerability with a CVSS score of 1.8 (LOW). Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved in...
How severe is CVE-2024-52525?
CVE-2024-52525 has been rated LOW with a CVSS base score of 1.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-52525?
Check the references section above for vendor advisories and patch information. Affected products include: Nextcloud Nextcloud Server.