CVE-2024-52512

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

user_oidc app is an OpenID Connect user backend for Nextcloud. A malicious user could send a malformed login link that would redirect the user to a provided URL after successfully authenticating. It is recommended that the Nextcloud User OIDC app is upgraded to 6.1.0.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published
Nov 15, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-525134.3Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user CVE-2024-525143.5Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files accCVE-2024-525156.5Nextcloud Server is a self hosted personal cloud system. After an admin enables the default-disabled SVG preview provider, a malicious user CVE-2024-525164.3Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own gCVE-2024-525175.9Nextcloud Server is a self hosted personal cloud system. After storing "Global credentials" on the server, the API returns them and adds theCVE-2024-525185.4Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attackeCVE-2024-525198.2Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker thaCVE-2024-52525.4The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_info_table shorCVE-2024-525206.5Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked inCVE-2024-525215.3Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased CVE-2024-525225.4Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks CVE-2024-525236.5Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed creden
CVE-2024-52512: Medium severity, CVSS 6.1 | Vulnix