CVE-2024-52525

LOW

Published 2024-11-15T16:30:28.401Z

Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2024-52525. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1

1.8

/10

CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N

Base Score Metrics

Exploitability: N/A Impact: N/A

EPSS Score

v2025.03.14

0.000

probability

of exploitation in the wild

There is a 0.0% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-06-25

Exploit Probability

Percentile: 0.114

Higher than 11.4% of all CVEs

Attack Vector Metrics

Attack Vector

PHYSICAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Impact Metrics

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Description

Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved in the session storage (Redis or disk), but it would allow a malicious process that gains access to the memory of the PHP process, to get access to the cleartext password of the user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

nextcloud

security-advisories

Affected Versions:

>= 28.0.0, < 28.0.12 >= 29.0.0, < 29.0.9 >= 30.0.0, < 30.0.2

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w7v5-mgxm-v6gm

https://github.com/nextcloud/server/pull/48915

https://github.com/nextcloud/server/commit/d25a0a2896a2a981939cacb8ee0d555feef22b3b

Published: 2024-11-15T16:30:28.401Z

Last Modified: 2024-11-15T17:10:50.412Z

Copied to clipboard!