ALT-PU-2025-1734-3 — nextcloud

BDU:2024-00708

CRITICAL9.8

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server, связанная с отсутствием ограничений попыток аутентификации, позволяющая нарушителю обойти процесс аутентификации

Published: 2024-01-25Modified: 2024-06-28

CVSS 3.xCRITICAL 9.8

CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0CRITICAL 10.0

CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C

References

CVE-2023-49792

BDU:2024-00723

LOW3.0

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server, связанная с неверным сроком действия сеанса, позволяющая нарушителю обойти процесс аутентификации

Published: 2024-01-25Modified: 2025-05-27

CVSS 3.xLOW 3.0

CVSS:3.x/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N

CVSS 2.0LOW 2.1

CVSS:2.0/AV:N/AC:H/Au:S/C:P/I:N/A:N

References

CVE-2024-22403

BDU:2024-04840

HIGH7.3

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server и Nextcloud Enterprise Server, связанная с недостатками процедуры аутентификации, позволяющая нарушителю обойти процесс аутентификации

Published: 2024-06-28

CVSS 3.xHIGH 7.3

CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CVSS 2.0HIGH 7.5

CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P

References

CVE-2024-37313

BDU:2024-04871

LOW3.5

Уязвимость компонента Calendar облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server, позволяющая нарушителю получить доступ к конфиденциальной информации

Published: 2024-06-28

CVSS 3.xLOW 3.5

CVSS:3.x/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

CVSS 2.0MEDIUM 4.0

CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:N

References

CVE-2024-37887

BDU:2024-04872

LOW3.5

Уязвимость функции files_versions() облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server, позволяющая нарушителю восстановить старые версии документа

Published: 2024-06-28

CVSS 3.xLOW 3.5

CVSS:3.x/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CVSS 2.0MEDIUM 4.0

CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:P/A:N

References

CVE-2024-37315

BDU:2024-04873

LOW3.5

Уязвимость компонента Delete облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2024-06-28

CVSS 3.xLOW 3.5

CVSS:3.x/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

CVSS 2.0MEDIUM 4.0

CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:N/A:P

References

CVE-2024-37884

BDU:2024-04874

HIGH8.1

Уязвимость компонента Share облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server, позволяющая нарушителю оказать воздействие на целостность данных или вызвать отказ в обслуживании

Published: 2024-06-28

CVSS 3.xHIGH 8.1

CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CVSS 2.0HIGH 8.5

CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:C/A:C

References

CVE-2024-37882

BDU:2024-04875

MEDIUM5.4

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server, связанная с неправильной аутентификацией, позволяющая нарушителю обойти процесс аутентификации

Published: 2024-06-28Modified: 2025-05-27

CVSS 3.xMEDIUM 5.4

CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CVSS 2.0MEDIUM 5.5

CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:P/A:P

References

CVE-2023-49791

BDU:2024-10840

LOW1.8

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server и Nextcloud Enterprise Server, связанная с хранением защищаемой информации в незашифрованном виде, позволяющая нарушителю получить доступ к конфиденциальной информации

Published: 2024-12-06

CVSS 3.xLOW 1.8

CVSS:3.x/AV:P/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N

CVSS 2.0LOW 0.8

CVSS:2.0/AV:L/AC:H/Au:M/C:P/I:N/A:N

References

CVE-2024-52525

BDU:2024-10841

MEDIUM5.7

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server и Nextcloud Enterprise Server, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2024-12-06

CVSS 3.xMEDIUM 5.7

CVSS:3.x/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

CVSS 2.0MEDIUM 6.8

CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:N/A:C

References

CVE-2024-52520

BDU:2024-10845

LOW2.7

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server и Nextcloud Enterprise Server, связанная с незащищённым хранением конфиденциальной информации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Published: 2024-12-06

CVSS 3.xLOW 2.7

CVSS:3.x/AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

CVSS 2.0LOW 2.3

CVSS:2.0/AV:L/AC:H/Au:M/C:P/I:P/A:N

References

CVE-2024-52519

BDU:2024-10846

MEDIUM4.6

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server и Nextcloud Enterprise Server, связанная с недостаточной защитой служебных данных, позволяющая нарушителю оказывать влияние на конфиденциальность

Published: 2024-12-06

CVSS 3.xMEDIUM 4.6

CVSS:3.x/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N

CVSS 2.0LOW 0.8

CVSS:2.0/AV:L/AC:H/Au:M/C:P/I:N/A:N

References

CVE-2024-52517

BDU:2024-10847

MEDIUM4.6

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server и Nextcloud Enterprise Server, связанная с недостаточной защитой служебных данных, позволяющая нарушителю оказывать влияние на конфиденциальность

Published: 2024-12-06Modified: 2026-04-09

CVSS 3.xMEDIUM 4.6

CVSS:3.x/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N

CVSS 2.0LOW 2.3

CVSS:2.0/AV:L/AC:H/Au:M/C:P/I:P/A:N

References

CVE-2024-52523

BDU:2024-10851

MEDIUM4.4

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server и Nextcloud Enterprise Server, связанная с недостатками процедуры аутентификации, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2024-12-06

CVSS 3.xMEDIUM 4.4

CVSS:3.x/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

CVSS 2.0MEDIUM 4.6

CVSS:2.0/AV:N/AC:H/Au:M/C:C/I:N/A:N

References

CVE-2024-52518

BDU:2024-10852

LOW3.0

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server и Nextcloud Enterprise Server, связанная с небезопасным управлением привилегиями, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2024-12-06

CVSS 3.xLOW 3.0

CVSS:3.x/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N

CVSS 2.0LOW 2.6

CVSS:2.0/AV:N/AC:H/Au:N/C:P/I:N/A:N

References

CVE-2024-52516

BDU:2024-10853

LOW2.6

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server и Nextcloud Enterprise Server, связанная с использованием обратимой односторонней хэш-функции, позволяющая нарушителю сделать фоновое задание актуальным

Published: 2024-12-06

CVSS 3.xLOW 2.6

CVSS:3.x/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

CVSS 2.0LOW 2.6

CVSS:2.0/AV:N/AC:H/Au:N/C:N/I:P/A:N

References

CVE-2024-52521

BDU:2025-07167

MEDIUM4.3

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server и Nextcloud Enterprise Server, связанная с неконтролируемым расходом ресурсов, позволяющая нарушителю оказать влияние на целостность защищаемой информации

Published: 2025-06-23

CVSS 3.xMEDIUM 4.3

CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CVSS 2.0MEDIUM 4.0

CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:P/A:N

References

CVE-2025-47793

BDU:2025-07168

MEDIUM4.3

Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server и Nextcloud Enterprise Server, связанная с недостаточной проверкой поступающих запросов, позволяющая нарушителю осуществить SSRF-атаку

Published: 2025-06-23

CVSS 3.xMEDIUM 4.3

CVSS:3.x/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVSS 2.0LOW 3.3

CVSS:2.0/AV:A/AC:L/Au:N/C:N/I:N/A:P

References

CVE-2025-47791

CVE-2023-49791

MEDIUM5.4

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when an attacker manages to get access to an active session of another user via another way, they could delete and modify workflows by sending calls directly to the API bypassing the password confirmation shown in the UI. Nextcloud Server versions 26.0.9 and 27.1.4 and Nextcloud Enterprise Server versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4 contain a patch for this issue. No known workarounds are available.

Published: 2023-12-22Modified: 2024-11-21

CVSS 3.xMEDIUM 5.4

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

CVE-2023-49792

CRITICAL9.8

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a (reverse) proxy is configured as trusted proxy the server could be tricked into reading a wrong remote address for an attacker, allowing them executing authentication attempts than intended. Nextcloud Server versions 26.0.9 and 27.1.4 and Nextcloud Enterprise Server versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4 contain a patch for this issue. No known workarounds are available.

Published: 2023-12-22Modified: 2024-11-21

CVSS 3.xCRITICAL 9.8

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

CVE-2024-22403

LOW3.7

Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any time using the code. As of version 28.0.0 OAuth codes are invalidated after 10 minutes and will no longer be authenticated. To exploit this vulnerability an attacker would need to intercept an OAuth code from a user session. It is recommended that the Nextcloud Server is upgraded to 28.0.0. There are no known workarounds for this vulnerability.

Published: 2024-01-18Modified: 2024-11-21

CVSS 3.xLOW 3.7

CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

CVE-2024-37313

HIGH7.5

Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providing the user credentials. It is recommended that the Nextcloud Server is upgraded to 26.0.13, 27.1.8 or 28.0.4 and Nextcloud Enterprise Server is upgraded to 21.0.9.17, 22.2.10.22, 23.0.12.17, 24.0.12.13, 25.0.13.8, 26.0.13, 27.1.8 or 28.0.4.

Published: 2024-06-14Modified: 2025-09-26

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

CVE-2024-37315

MEDIUM4.3

Nextcloud Server is a self hosted personal cloud system. An attacker with read-only access to a file is able to restore older versions of a document when the files_versions app is enabled. It is recommended that the Nextcloud Server is upgraded to 26.0.12, 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 23.0.12.16, 24.0.12.12, 25.0.13.6, 26.0.12, 27.1.7 or 28.0.3.

Published: 2024-06-14Modified: 2024-11-21

CVSS 3.xMEDIUM 4.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

CVE-2024-37882

HIGH8.1

Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4 and that the Nextcloud Enterprise Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4.

Published: 2024-06-14Modified: 2024-11-21

CVSS 3.xHIGH 8.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

CVE-2024-37884

MEDIUM5.4

Nextcloud Server is a self hosted personal cloud system. A malicious user was able to send delete requests for old versions of files they only got shared with read permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3 and that the Nextcloud Enterprise Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3.

Published: 2024-06-14Modified: 2024-11-21

CVSS 3.xMEDIUM 5.4

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

CVE-2024-37887

LOW3.5

Nextcloud Server is a self hosted personal cloud system. Private shared calendar events' recurrence exceptions can be read by sharees. It is recommended that the Nextcloud Server is upgraded to 27.1.10 or 28.0.6 or 29.0.1 and that the Nextcloud Enterprise Server is upgraded to 27.1.10 or 28.0.6 or 29.0.1.

Published: 2024-06-14Modified: 2025-10-02

CVSS 3.xLOW 3.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

References

CVE-2024-52513

MEDIUM4.3

Nextcloud Server is a self hosted personal cloud system. After receiving a "Files drop" or "Password protected" share link a malicious user was able to download attachments that are referenced in Text files without providing the password. It is recommended that the Nextcloud Server is upgraded to 28.0.11, 29.0.8 or 30.0.1 and Nextcloud Enterprise Server is upgraded to 25.0.13.13, 26.0.13.9, 27.1.11.9, 28.0.11, 29.0.8 or 30.0.1.

Published: 2024-11-15Modified: 2025-10-01

CVSS 3.xMEDIUM 4.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References

CVE-2024-52516

MEDIUM4.3

Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own groups, after a user was removed from a group, previously shared items were not unshared. It is recommended that the Nextcloud Server is upgraded to 22.2.11 or 23.0.11 or 24.0.6 and Nextcloud Enterprise Server is upgraded to 22.2.11 or 23.0.11 or 24.0.6.

Published: 2024-11-15Modified: 2025-01-06

CVSS 3.xMEDIUM 4.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

CVE-2024-52517

MEDIUM5.9

Nextcloud Server is a self hosted personal cloud system. After storing "Global credentials" on the server, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active session of a user. It is recommended that the Nextcloud Server is upgraded to 28.0.11, 29.0.8 or 30.0.1 and Nextcloud Enterprise Server is upgraded to 25.0.13.13, 26.0.13.9, 27.1.11.9, 28.0.11, 29.0.8 or 30.0.1.

Published: 2024-11-15Modified: 2025-01-06

CVSS 3.xMEDIUM 5.9

CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

CVE-2024-52518

MEDIUM5.4

Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external storages without having to confirm the password. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2.

Published: 2024-11-15Modified: 2025-01-23

CVSS 3.xMEDIUM 5.4

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

CVE-2024-52519

HIGH8.2

Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a backup of the database and the Nextcloud config file, would be able to decrypt them. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7.

Published: 2024-11-15Modified: 2025-01-23

CVSS 3.xHIGH 8.2

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

CVE-2024-52520

MEDIUM6.5

Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than intended, to find open-graph data. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7.

Published: 2024-11-15Modified: 2025-09-05

CVSS 3.xMEDIUM 6.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

CVE-2024-52521

MEDIUM5.3

Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely being identified as already existing and not be queued for execution. By changing the Hash to SHA256 the probability was heavily decreased. It is recommended that the Nextcloud Server is upgraded to 28.0.10, 29.0.7 or 30.0.0.

Published: 2024-11-15Modified: 2025-01-23

CVSS 3.xMEDIUM 5.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

CVE-2024-52523

MEDIUM6.5

Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active session of a user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2 and Nextcloud Enterprise Server is upgraded to 25.0.13.14, 26.0.13.10, 27.1.11.10, 28.0.12, 29.0.9 or 30.0.2.

Published: 2024-11-15Modified: 2025-10-01

CVSS 3.xMEDIUM 6.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

CVE-2024-52525

HIGH7.5

Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved in the session storage (Redis or disk), but it would allow a malicious process that gains access to the memory of the PHP process, to get access to the cleartext password of the user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2.

Published: 2024-11-15Modified: 2025-01-23

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

CVE-2025-47791

MEDIUM5.3

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently unused endpoint to verify a share recipient was not protected correctly, allowing to proxy requests to another server. The endpoint was removed in Nextcloud Server 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server 28.0.13, 29.0.10, and 30.0.3. No known workarounds are available.

Published: 2025-05-16Modified: 2025-09-19

CVSS 3.xMEDIUM 5.3

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

CVE-2025-47793

MEDIUM6.5

Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team. In Nextcloud Server prior to 30.0.2, 29.0.9, and 28.0.1, Nextcloud Enterprise Server prior to 30.0.2 and 29.0.9, and Nextcloud Groupfolders app prior to 18.0.3, 17.0.5, and 16.0.11, the absence of quota checking on attachments allowed logged-in users to upload files exceeding the group folder quota. Nextcloud Server versions 30.0.2 and 29.0.9, Nextcloud Enterprise Server versions 30.0.2, 29.0.9, or 28.0.12, and Nextcloud Groupfolders app 18.0.3, 17.0.5, and 16.0.11 fix the issue. No known workarounds are available.

Published: 2025-05-16Modified: 2025-09-08

CVSS 3.xMEDIUM 6.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Package update nextcloud in branch c10f2

Closed issues (37)

Closed bugs (1)

Nextcloud большое количество процессов httpd