Unencrypted Password Storage Vulnerability in Nextcloud Server

CVE-2024-52525

What is CVE-2024-52525?

Nextcloud Server, a self-hosted personal cloud solution, faces a vulnerability that results in user passwords being stored unencrypted within session data. While the session data is intended to be encrypted when saved to storage mechanisms like Redis or disk, exploitation is possible for any malicious entity gaining access to the memory of the PHP process. This could lead to the exposure of plaintext passwords. Users are strongly advised to upgrade to Nextcloud Server version 28.0.12, 29.0.9, or 30.0.2 to mitigate this risk.

References