← Back

CVE-2024-52509

nvd nist
Published: Nov 15, 2024Modified: Jun 17, 2026

JSON object

Loading...
5.7
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Exploitability: 2.1 / Impact: 3.6
Source: NVD

Description

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments. This allowed users to send them the files to themselves and then downloading it from their mail clients. It is recommended that the Nextcloud Mail is upgraded to 2.2.10, 3.6.2 or 3.7.2.

Affected (3)

Products: Nextcloud: Mail
Nextcloud
1 product
Mail
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Nextcloud
Mail
From 2.2.0 to 2.2.10
Mail
From 3.6.0 to 3.6.2
Mail
From 3.7.0 to 3.7.2

Related CWEs

CWE-284
Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (4)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
PatchVendor Advisory
Source: security-advisories@github.com
Issue Tracking

Timeline

No history available yet.