Vulnerability record · CVE-2024-52523 · published 15 November 2024

CVE-2024-52523: Nextcloud server information exposure vulnerability

Nextcloud · Nextcloud Server

Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active session of a user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2 and Nextcloud Enterprise Server is upgraded to 25.0.13.14, 26.0.13.10, 27.1.11.10, 28.0.12, 29.0.9 or 30.0.2.

6.5 CVSS 3.1 Medium EPSS 0.64% · top 51.4% CWE-200 · Information exposureCWE-125 · Out-of-bounds read

6.5CVSS 3.1 base score

0.64%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

3References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Nextcloud Server Nextcloud

References

Link	Tags
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-42w6-r45m-9w9j	Vendor Advisory
https://github.com/nextcloud/server/commit/8a13f284765bd4606984e7d925c32ae6e82b8a27	Patch
https://github.com/nextcloud/server/pull/49009	Issue Tracking

Track CVE-2024-52523 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-49792Nextcloud server improper restriction of authentication attempts vulnerabilityNextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well…EPSS 1.0%22 Dec 2023 9.8CVE-2023-48306Nextcloud server server-side request forgery (ssrf) vulnerabilityNextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6…EPSS 0.80%21 Nov 2023 9.8CVE-2021-32802Nextcloud server inclusion from untrusted sphere vulnerabilityNextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user provided file content. For some …EPSS 2.6%7 Sep 2021 9.8CVE-2021-32726Nextcloud server improper authentication vulnerabilityNextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, webauthn tokens were not deleted…EPSS 1.8%12 Jul 2021 9.8CVE-2021-22915Nextcloud server improper restriction of authentication attempts vulnerabilityNextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting consi…EPSS 1.7%11 Jun 2021 9.1CVE-2023-35172Nextcloud server improper restriction of authentication attempts vulnerabilityNextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server version…EPSS 0.92%23 Jun 2023 9.1CVE-2021-32654Nextcloud server insecure direct object reference vulnerabilityNextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to receive …EPSS 1.8%1 Jun 2021 8.8CVE-2023-45151Nextcloud server cleartext storage of sensitive data vulnerabilityNextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who…EPSS 0.48%16 Oct 2023

Source: NIST National Vulnerability Database (record CVE-2024-52523), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.