PT-2024-35350 · Nextcloud · Nextcloud Tables

Tuyenee · Published 2024-11-15 · Updated 2025-10-01 · CVE-2024-52511

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Tables versions prior to 0.8.0

Description The issue allows a malicious user to insert new rows into tables they have no access to by directly specifying the ID of a table or view.

Recommendations For versions prior to 0.8.0, upgrade to version 0.8.0 to resolve the issue.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-52511

GHSA-4QQP-9H2G-7QG7

Affected Products

Nextcloud Tables

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52511.json · Exploit
• https://github.com/nextcloud/tables/commit/52846ad81fe192ee977f14c82a229b0d9cdc406c · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4qqp-9h2g-7qg7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52511 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52511 · Security Note
• https://github.com/nextcloud/tables/pull/1351 · Note
• https://twitter.com/CVEnew/status/1857476916850127033 · Twitter Post
• https://t.me/cveNotify/137084 · Telegram Post
• https://hackerone.com/reports/2671404 · Note
• https://t.me/cvedetector/11136 · Telegram Post