PT-2024-35352 · Nextcloud+1 · Nextcloud Server+2

Lukasreschke · Published 2024-11-15 · Updated 2025-10-01 · CVE-2024-52513

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 28.0.11 Nextcloud Server versions prior to 29.0.8 Nextcloud Server versions prior to 30.0.1 Nextcloud Enterprise Server versions prior to 25.0.13.13 Nextcloud Enterprise Server versions prior to 26.0.13.9 Nextcloud Enterprise Server versions prior to 27.1.11.9 Nextcloud Enterprise Server versions prior to 28.0.11 Nextcloud Enterprise Server versions prior to 29.0.8 Nextcloud Enterprise Server versions prior to 30.0.1

Description The issue allows a malicious user to download attachments referenced in text files without providing a password after receiving a "Files drop" or "Password protected" share link.

Recommendations Upgrade Nextcloud Server to version 28.0.11 Upgrade Nextcloud Server to version 29.0.8 Upgrade Nextcloud Server to version 30.0.1 Upgrade Nextcloud Enterprise Server to version 25.0.13.13 Upgrade Nextcloud Enterprise Server to version 26.0.13.9 Upgrade Nextcloud Enterprise Server to version 27.1.11.9 Upgrade Nextcloud Enterprise Server to version 28.0.11 Upgrade Nextcloud Enterprise Server to version 29.0.8 Upgrade Nextcloud Enterprise Server to version 30.0.1

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2025-1663

ALT-PU-2025-1855

ALT-PU-2025-2137

CVE-2024-52513

GHSA-GXPH-5M4J-PFMJ

Affected Products

Alt Linux

Nextcloud Enterprise Server

Nextcloud Server

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52513.json · Exploit
• https://github.com/nextcloud/text/commit/ca24b25c93b81626b4e457c260243edeab5f1548 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-gxph-5m4j-pfmj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52513 · Security Note
• https://osv.dev/vulnerability/CVE-2024-52513 · Vendor Advisory
• https://github.com/nextcloud/text/pull/6485 · Note
• https://twitter.com/CVEnew/status/1857476920679579734 · Twitter Post
• https://t.me/cveNotify/137085 · Telegram Post
• https://hackerone.com/reports/2376900 · Note
• https://t.me/cvedetector/11130 · Telegram Post