Nextcloud Server Group Permission Issue
CVE-2024-52516

4.3MEDIUM

Key Information:

Vendor

Nextcloud
Status
Nextcloud Server
Vendor
CVE Published:
15 November 2024

What is CVE-2024-52516?

Nextcloud Server contains a permissions vulnerability affecting the way shared items are handled when a user is removed from a group. Specifically, if the server is configured to restrict sharing to users within specific groups, previously shared items remain accessible to the removed user. This issue highlights potential data exposure risks and emphasizes the necessity for users to upgrade to the latest versions to mitigate such vulnerabilities. The recommended updates are Nextcloud Server versions 22.2.11, 23.0.11, and 24.0.6, as well as Nextcloud Enterprise Server versions 22.2.11, 23.0.11, and 24.0.6.

References

https://github.com/nextcloud/security-advisories/security...
https://github.com/nextcloud/server/pull/47180
https://github.com/nextcloud/server/commit/142b6e313ffa9d...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.