CVE-2024-52509

MediumCVSS 5.7/10Last modified Jun 17, 2026

Description

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments. This allowed users to send them the files to themselves and then downloading it from their mail clients. It is recommended that the Nextcloud Mail is upgraded to 2.2.10, 3.6.2 or 3.7.2.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Nov 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-52515.4The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_pricing shortc CVE-2024-525107.5The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with a CVE-2024-525116.5Nextcloud Tables allows users to to create tables with individual columns. By directly specifying the ID of a table or view, a malicious use CVE-2024-525126.1user_oidc app is an OpenID Connect user backend for Nextcloud. A malicious user could send a malformed login link that would redirect the us CVE-2024-525134.3Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user CVE-2024-525143.5Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files acc CVE-2024-525156.5Nextcloud Server is a self hosted personal cloud system. After an admin enables the default-disabled SVG preview provider, a malicious user CVE-2024-525164.3Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own g CVE-2024-525175.9Nextcloud Server is a self hosted personal cloud system. After storing "Global credentials" on the server, the API returns them and adds the CVE-2024-525185.4Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacke CVE-2024-525198.2Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker tha CVE-2024-52525.4The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_info_table shor