CVE-2024-52519

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a backup of the database and the Nextcloud config file, would be able to decrypt them. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-922

Affected software

No affected versions have been published.

Timeline

Published: Nov 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-52525.4The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_info_table shor CVE-2024-525206.5Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked in CVE-2024-525215.3Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased CVE-2024-525225.4Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks CVE-2024-525236.5Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed creden CVE-2024-525246.9Giskard is an evaluation and testing framework for AI systems. A Remote Code Execution (ReDoS) vulnerability was discovered in Giskard compo CVE-2024-525257.5Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the sessi CVE-2024-525265.4LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Servic CVE-2024-525289.3Budget Control Gateway acts as an entry point for incoming requests and routes them to the appropriate microservices for Budget Control. Bud CVE-2024-525295.8Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For users with the following configuration: 1. An CVE-2024-52535.4The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ult_team shortcode in al CVE-2024-525307.5GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignor