PT-2024-35347 · Nextcloud · Nextcloud Tables

Arianitisufi · Published 2024-11-15 · Updated 2025-10-01 · CVE-2024-52507

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Tables versions prior to 0.8.1

Description The issue concerns the sharing of table information in Nextcloud Tables, where the details about which table (identified by a numeric ID) is shared with specific groups and users, along with the respective permissions, were not properly restricted to affected users.

Recommendations For versions prior to 0.8.1, upgrade the Nextcloud Tables app to version 0.8.1 to resolve the issue.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-52507

GHSA-RGVC-XR2W-QQ45

Affected Products

Nextcloud Tables

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52507.json · Exploit
• https://github.com/nextcloud/tables/commit/13ca45f1b9f70f694aea81b78bc7416ec840c332 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-rgvc-xr2w-qq45 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52507 · Security Note
• https://osv.dev/vulnerability/CVE-2024-52507 · Vendor Advisory
• https://github.com/nextcloud/tables/pull/1406 · Note
• https://hackerone.com/reports/2705507 · Note
• https://t.me/cveNotify/137082 · Telegram Post
• https://t.me/cvedetector/11143 · Telegram Post
• https://twitter.com/CVEnew/status/1857476915646332991 · Twitter Post