Riskcovery

CVE-2024-52509

Nextcloud Mail app does not respect download permissions in shares

State
Published
Severity
3.5 Low
Published
Nov 15, 2024
Updated
Nov 15, 2024
Reserved
Nov 11, 2024

Read the record on cve.org

Description

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments. This allowed users to send them the files to themselves and then downloading it from their mail clients. It is recommended that the Nextcloud Mail is upgraded to 2.2.10, 3.6.2 or 3.7.2.

Scores

CVSSScoreVectorSource
3.13.5 LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:NGitHub_M

Weaknesses

Affected Products

ProductVersions
security-advisoriesnextcloud
  • >=2.2.0, < 2.2.10Affected
  • >= 3.6.0, < 3.6.2Affected
  • >= 3.7.0, < 3.7.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.