PT-2023-9699 · Nextcloud+1 · Nextcloud Enterprise Server+2

Maccs · Published 2023-11-21 · Updated 2025-10-01 · CVE-2024-52514

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 27.1.9 Nextcloud Server versions prior to 28.0.5 Nextcloud Server versions prior to 29.0.0 Nextcloud Enterprise Server versions prior to 21.0.9.18 Nextcloud Enterprise Server versions prior to 22.2.10.23 Nextcloud Enterprise Server versions prior to 23.0.12.18 Nextcloud Enterprise Server versions prior to 24.0.12.14 Nextcloud Enterprise Server versions prior to 25.0.13.9 Nextcloud Enterprise Server versions prior to 26.0.13.3

Description The issue is related to incorrect access control in Nextcloud Server, allowing a remote attacker to access confidential information. Specifically, after a user receives a share with blocked files, they can still copy the intermediate folder, potentially accessing the blocked files depending on user access control rules.

Recommendations Upgrade Nextcloud Server to version 27.1.9 or later. Upgrade Nextcloud Server to version 28.0.5 or later. Upgrade Nextcloud Server to version 29.0.0 or later. Upgrade Nextcloud Enterprise Server to version 21.0.9.18 or later. Upgrade Nextcloud Enterprise Server to version 22.2.10.23 or later. Upgrade Nextcloud Enterprise Server to version 23.0.12.18 or later. Upgrade Nextcloud Enterprise Server to version 24.0.12.14 or later. Upgrade Nextcloud Enterprise Server to version 25.0.13.9 or later. Upgrade Nextcloud Enterprise Server to version 26.0.13.3 or later. As a temporary workaround, consider restricting access to shared folders with blocked files until the upgrade is applied.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2024-10199

CVE-2024-52514

GHSA-G8PR-G25R-58XJ

Affected Products

Nextcloud Enterprise Server

Nextcloud Server

Red Os

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52514.json · Exploit
• https://github.com/nextcloud/server/commit/5fffbcfe8650eab75b00e8d188fbc95b0e43f3a8 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g8pr-g25r-58xj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52514 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10199 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-52514 · Security Note
• https://github.com/nextcloud/server/pull/44889 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52514 · Note
• https://twitter.com/CVEnew/status/1857476921992397200 · Twitter Post
• https://redos.red-soft.ru/support/secure · Note
• https://t.me/cvedetector/11131 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-nextcloud-cve-2024-52514-cve-2024-52515 · Note
• https://hackerone.com/reports/2447316 · Note
• https://t.me/cveNotify/137076 · Telegram Post