CVE-2024-52515

Katalog CVE

CVSS 6.5 · Medium EPSS 0,66%

Kerentanan Use of Incorrectly-Resolved Name or Reference pada nextcloud server. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Nextcloud Server is a self hosted personal cloud system. After an admin enables the default-disabled SVG preview provider, a malicious user could upload a manipulated SVG file referencing paths. If the file would exist the preview of the SVG would preview the other file instead. It is recommended that the Nextcloud Server is upgraded to 27.1.10, 28.0.6 or 29.0.1 and Nextcloud Enterprise Server is upgraded to 24.0.12.15, 25.0.13.10, 26.0.13.4, 27.1.10, 28.0.6 or 29.0.1.

Rincian

Terbit di NVD

15 November 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-706: Use of Incorrectly-Resolved Name or Reference

EPSS (30 hari)

0,66% peluang dieksploitasi; lebih tinggi dari 50,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5m5g-hw8c-2236 advisory vendor
• https://github.com/nextcloud/server/commit/7e1c30f82a63fbea8c269e0eec38291377f32604 patch
• https://github.com/nextcloud/server/pull/45340 issue tracking
• https://hackerone.com/reports/2484499 issue tracking