All errata/p10/ALT-PU-2024-14169-3
ALT-PU-2024-14169-3

Package update nextcloud in branch p10

Version30.0.0-alt1
Task#359901
Published2026-02-04
Max severityCRITICAL
Severity:

Closed issues (24)

BDU:2024-00708
CRITICAL9.8

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server, связанная с отсутствием ограничений попыток аутентификации, позволяющая нарушителю обойти процесс аутентификации

Published: 2024-01-25Modified: 2024-06-28
CVSS 3.xCRITICAL 9.8
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0CRITICAL 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
References
BDU:2024-00723
LOW3.0

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server, связанная с неверным сроком действия сеанса, позволяющая нарушителю обойти процесс аутентификации

Published: 2024-01-25Modified: 2025-05-27
CVSS 3.xLOW 3.0
CVSS:3.x/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N
CVSS 2.0LOW 2.1
CVSS:2.0/AV:N/AC:H/Au:S/C:P/I:N/A:N
References
BDU:2024-04840
HIGH7.3

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server и Nextcloud Enterprise Server, связанная с недостатками процедуры аутентификации, позволяющая нарушителю обойти процесс аутентификации

Published: 2024-06-28
CVSS 3.xHIGH 7.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
References
BDU:2024-04871
LOW3.5

Уязвимость компонента Calendar облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server, позволяющая нарушителю получить доступ к конфиденциальной информации

Published: 2024-06-28
CVSS 3.xLOW 3.5
CVSS:3.x/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS 2.0MEDIUM 4.0
CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:N
References
BDU:2024-04872
LOW3.5

Уязвимость функции files_versions() облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server, позволяющая нарушителю восстановить старые версии документа

Published: 2024-06-28
CVSS 3.xLOW 3.5
CVSS:3.x/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS 2.0MEDIUM 4.0
CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:P/A:N
References
BDU:2024-04873
LOW3.5

Уязвимость компонента Delete облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2024-06-28
CVSS 3.xLOW 3.5
CVSS:3.x/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
CVSS 2.0MEDIUM 4.0
CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:N/A:P
References
BDU:2024-04874
HIGH8.1

Уязвимость компонента Share облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server, позволяющая нарушителю оказать воздействие на целостность данных или вызвать отказ в обслуживании

Published: 2024-06-28
CVSS 3.xHIGH 8.1
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS 2.0HIGH 8.5
CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:C/A:C
References
BDU:2024-04875
MEDIUM5.4

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server, связанная с неправильной аутентификацией, позволяющая нарушителю обойти процесс аутентификации

Published: 2024-06-28Modified: 2025-05-27
CVSS 3.xMEDIUM 5.4
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS 2.0MEDIUM 5.5
CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:P/A:P
References
BDU:2024-10841
MEDIUM5.7

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server и Nextcloud Enterprise Server, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2024-12-06
CVSS 3.xMEDIUM 5.7
CVSS:3.x/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:N/A:C
References
BDU:2024-10845
LOW2.7

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server и Nextcloud Enterprise Server, связанная с незащищённым хранением конфиденциальной информации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Published: 2024-12-06
CVSS 3.xLOW 2.7
CVSS:3.x/AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
CVSS 2.0LOW 2.3
CVSS:2.0/AV:L/AC:H/Au:M/C:P/I:P/A:N
References
BDU:2024-10852
LOW3.0

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server и Nextcloud Enterprise Server, связанная с небезопасным управлением привилегиями, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2024-12-06
CVSS 3.xLOW 3.0
CVSS:3.x/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N
CVSS 2.0LOW 2.6
CVSS:2.0/AV:N/AC:H/Au:N/C:P/I:N/A:N
References
BDU:2024-10853
LOW2.6

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server и Nextcloud Enterprise Server, связанная с использованием обратимой односторонней хэш-функции, позволяющая нарушителю сделать фоновое задание актуальным

Published: 2024-12-06
CVSS 3.xLOW 2.6
CVSS:3.x/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS 2.0LOW 2.6
CVSS:2.0/AV:N/AC:H/Au:N/C:N/I:P/A:N
References
CVE-2023-49791
MEDIUM5.4

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when an attacker manages to get access to an active session of another user via another way, they could delete and modify workflows by sending calls directly to the API bypassing the password confirmation shown in the UI. Nextcloud Server versions 26.0.9 and 27.1.4 and Nextcloud Enterprise Server versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4 contain a patch for this issue. No known workarounds are available.

Published: 2023-12-22Modified: 2024-11-21
CVSS 3.xMEDIUM 5.4
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
References
CVE-2023-49792
CRITICAL9.8

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a (reverse) proxy is configured as trusted proxy the server could be tricked into reading a wrong remote address for an attacker, allowing them executing authentication attempts than intended. Nextcloud Server versions 26.0.9 and 27.1.4 and Nextcloud Enterprise Server versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4 contain a patch for this issue. No known workarounds are available.

Published: 2023-12-22Modified: 2024-11-21
CVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
CVE-2024-22403
LOW3.7

Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any time using the code. As of version 28.0.0 OAuth codes are invalidated after 10 minutes and will no longer be authenticated. To exploit this vulnerability an attacker would need to intercept an OAuth code from a user session. It is recommended that the Nextcloud Server is upgraded to 28.0.0. There are no known workarounds for this vulnerability.

Published: 2024-01-18Modified: 2024-11-21
CVSS 3.xLOW 3.7
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
References
CVE-2024-37313
HIGH7.5

Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providing the user credentials. It is recommended that the Nextcloud Server is upgraded to 26.0.13, 27.1.8 or 28.0.4 and Nextcloud Enterprise Server is upgraded to 21.0.9.17, 22.2.10.22, 23.0.12.17, 24.0.12.13, 25.0.13.8, 26.0.13, 27.1.8 or 28.0.4.

Published: 2024-06-14Modified: 2025-09-26
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
CVE-2024-37315
MEDIUM4.3

Nextcloud Server is a self hosted personal cloud system. An attacker with read-only access to a file is able to restore older versions of a document when the files_versions app is enabled. It is recommended that the Nextcloud Server is upgraded to 26.0.12, 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 23.0.12.16, 24.0.12.12, 25.0.13.6, 26.0.12, 27.1.7 or 28.0.3.

Published: 2024-06-14Modified: 2024-11-21
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
References
CVE-2024-37882
HIGH8.1

Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4 and that the Nextcloud Enterprise Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4.

Published: 2024-06-14Modified: 2024-11-21
CVSS 3.xHIGH 8.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
CVE-2024-37884
MEDIUM5.4

Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with read permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3.

Published: 2024-06-14Modified: 2024-11-21
CVSS 3.xMEDIUM 5.4
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
References
CVE-2024-37887
LOW3.5

Nextcloud Server is a self hosted personal cloud system. Private shared calendar events' recurrence exceptions can be read by sharees. It is recommended that the Nextcloud Server is upgraded to 27.1.10 or 28.0.6 or 29.0.1 and that the Nextcloud Enterprise Server is upgraded to 27.1.10 or 28.0.6 or 29.0.1.

Published: 2024-06-14Modified: 2025-10-02
CVSS 3.xLOW 3.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
References
CVE-2024-52516
MEDIUM4.3

Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own groups, after a user was removed from a group, previously shared items were not unshared. It is recommended that the Nextcloud Server is upgraded to 22.2.11 or 23.0.11 or 24.0.6 and Nextcloud Enterprise Server is upgraded to 22.2.11 or 23.0.11 or 24.0.6.

Published: 2024-11-15Modified: 2025-01-06
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
CVE-2024-52519
HIGH8.2

Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a backup of the database and the Nextcloud config file, would be able to decrypt them. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7.

Published: 2024-11-15Modified: 2025-01-23
CVSS 3.xHIGH 8.2
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
References
CVE-2024-52520
MEDIUM6.5

Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than intended, to find open-graph data. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7.

Published: 2024-11-15Modified: 2025-09-05
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References
CVE-2024-52521
MEDIUM5.3

Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely being identified as already existing and not be queued for execution. By changing the Hash to SHA256 the probability was heavily decreased. It is recommended that the Nextcloud Server is upgraded to 28.0.10, 29.0.7 or 30.0.0.

Published: 2024-11-15Modified: 2025-01-23
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References