CVE-2024-52514

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

Nextcloud Server is a self hosted personal cloud system. After a user received a share with some files inside being blocked by the files access control, the user would still be able to copy the intermediate folder inside Nextcloud allowing them to afterwards potentially access the blocked files depending on the user access control rules. It is recommended that the Nextcloud Server is upgraded to 27.1.9, 28.0.5 or 29.0.0 and Nextcloud Enterprise Server is upgraded to 21.0.9.18, 22.2.10.23, 23.0.12.18, 24.0.12.14, 25.0.13.9, 26.0.13.3, 27.1.9, 28.0.5 or 29.0.0.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Nov 15, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-525156.5Nextcloud Server is a self hosted personal cloud system. After an admin enables the default-disabled SVG preview provider, a malicious user CVE-2024-525164.3Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own gCVE-2024-525175.9Nextcloud Server is a self hosted personal cloud system. After storing "Global credentials" on the server, the API returns them and adds theCVE-2024-525185.4Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attackeCVE-2024-525198.2Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker thaCVE-2024-52525.4The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_info_table shorCVE-2024-525206.5Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked inCVE-2024-525215.3Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased CVE-2024-525225.4Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks CVE-2024-525236.5Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credenCVE-2024-525246.9Giskard is an evaluation and testing framework for AI systems. A Remote Code Execution (ReDoS) vulnerability was discovered in Giskard compoCVE-2024-525257.5Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the sessi
CVE-2024-52514: Low severity, CVSS 3.5 | Vulnix