ALT-PU-2024-15428-4

BDU:2024-10840

LOW1.8

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server и Nextcloud Enterprise Server, связанная с хранением защищаемой информации в незашифрованном виде, позволяющая нарушителю получить доступ к конфиденциальной информации

Published: 2024-12-06

CVSS 3.xLOW 1.8

CVSS:3.x/AV:P/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N

CVSS 2.0LOW 0.8

CVSS:2.0/AV:L/AC:H/Au:M/C:P/I:N/A:N

References

CVE-2024-52525

BDU:2024-10846

MEDIUM4.6

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server и Nextcloud Enterprise Server, связанная с недостаточной защитой служебных данных, позволяющая нарушителю оказывать влияние на конфиденциальность

Published: 2024-12-06

CVSS 3.xMEDIUM 4.6

CVSS:3.x/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N

CVSS 2.0LOW 0.8

CVSS:2.0/AV:L/AC:H/Au:M/C:P/I:N/A:N

References

CVE-2024-52517

BDU:2024-10847

MEDIUM4.6

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server и Nextcloud Enterprise Server, связанная с недостаточной защитой служебных данных, позволяющая нарушителю оказывать влияние на конфиденциальность

Published: 2024-12-06Modified: 2026-04-09

CVSS 3.xMEDIUM 4.6

CVSS:3.x/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N

CVSS 2.0LOW 2.3

CVSS:2.0/AV:L/AC:H/Au:M/C:P/I:P/A:N

References

CVE-2024-52523

BDU:2024-10851

MEDIUM4.4

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server и Nextcloud Enterprise Server, связанная с недостатками процедуры аутентификации, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2024-12-06

CVSS 3.xMEDIUM 4.4

CVSS:3.x/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

CVSS 2.0MEDIUM 4.6

CVSS:2.0/AV:N/AC:H/Au:M/C:C/I:N/A:N

References

CVE-2024-52518

BDU:2025-07167

MEDIUM4.3

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server и Nextcloud Enterprise Server, связанная с неконтролируемым расходом ресурсов, позволяющая нарушителю оказать влияние на целостность защищаемой информации

Published: 2025-06-23

CVSS 3.xMEDIUM 4.3

CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CVSS 2.0MEDIUM 4.0

CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:P/A:N

References

CVE-2025-47793

CVE-2024-52513

MEDIUM4.3

Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user was able to download attachments that are referenced in Text files without providing the password. It is recommended that the Nextcloud Server is upgraded to 28.0.11, 29.0.8 or 30.0.1 and Nextcloud Enterprise Server is upgraded to 25.0.13.13, 26.0.13.9, 27.1.11.9, 28.0.11, 29.0.8 or 30.0.1.

Published: 2024-11-15Modified: 2025-10-01

CVSS 3.xMEDIUM 4.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References

CVE-2024-52517

MEDIUM5.9

Nextcloud Server is a self hosted personal cloud system. After storing "Global credentials" on the server, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active session of a user. It is recommended that the Nextcloud Server is upgraded to 28.0.11, 29.0.8 or 30.0.1 and Nextcloud Enterprise Server is upgraded to 25.0.13.13, 26.0.13.9, 27.1.11.9, 28.0.11, 29.0.8 or 30.0.1.

Published: 2024-11-15Modified: 2025-01-06

CVSS 3.xMEDIUM 5.9

CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

CVE-2024-52518

MEDIUM5.4

Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external storages without having to confirm the password. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2.

Published: 2024-11-15Modified: 2025-01-23

CVSS 3.xMEDIUM 5.4

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

CVE-2024-52523

MEDIUM6.5

Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active session of a user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2 and Nextcloud Enterprise Server is upgraded to 25.0.13.14, 26.0.13.10, 27.1.11.10, 28.0.12, 29.0.9 or 30.0.2.

Published: 2024-11-15Modified: 2025-10-01

CVSS 3.xMEDIUM 6.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

CVE-2024-52525

HIGH7.5

Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved in the session storage (Redis or disk), but it would allow a malicious process that gains access to the memory of the PHP process, to get access to the cleartext password of the user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2.

Published: 2024-11-15Modified: 2025-01-23

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

CVE-2025-47793

MEDIUM6.5

Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team. In Nextcloud Server prior to 30.0.2, 29.0.9, and 28.0.1, Nextcloud Enterprise Server prior to 30.0.2 and 29.0.9, and Nextcloud Groupfolders app prior to 18.0.3, 17.0.5, and 16.0.11, the absence of quota checking on attachments allowed logged-in users to upload files exceeding the group folder quota. Nextcloud Server versions 30.0.2 and 29.0.9, Nextcloud Enterprise Server versions 30.0.2, 29.0.9, or 28.0.12, and Nextcloud Groupfolders app 18.0.3, 17.0.5, and 16.0.11 fix the issue. No known workarounds are available.

Published: 2025-05-16Modified: 2025-09-08

CVSS 3.xMEDIUM 6.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

CVE-2025-64011

MEDIUM4.3

Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint. Any authenticated user can access previews of arbitrary files belonging to other users by manipulating the fileId parameter. This allows unauthorized disclosure of sensitive data, such as text files or images, without prior sharing permissions.

Published: 2025-12-12Modified: 2025-12-19

CVSS 3.xMEDIUM 4.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

Package update nextcloud in branch sisyphus

Closed issues (12)

Closed bugs (1)

Nextcloud большое количество процессов httpd