CVE-2024-52520

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than intended, to find open-graph data. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-400CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Nov 15, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-525215.3Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased CVE-2024-525225.4Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks CVE-2024-525236.5Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credenCVE-2024-525246.9Giskard is an evaluation and testing framework for AI systems. A Remote Code Execution (ReDoS) vulnerability was discovered in Giskard compoCVE-2024-525257.5Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the sessiCVE-2024-525265.4LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "ServicCVE-2024-525289.3Budget Control Gateway acts as an entry point for incoming requests and routes them to the appropriate microservices for Budget Control. BudCVE-2024-525295.8Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For users with the following configuration: 1. AnCVE-2024-52535.4The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ult_team shortcode in alCVE-2024-525307.5GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignorCVE-2024-525316.5GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_parse_param_list_strict.CVE-2024-525327.5GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain patterns of WebSocket data from clien