CVE-2024-52521

Published: Nov 15, 2024Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely being identified as already existing and not be queued for execution. By changing the Hash to SHA256 the probability was heavily decreased. It is recommended that the Nextcloud Server is upgraded to 28.0.10, 29.0.7 or 30.0.0.

Affected (4)

Products: Nextcloud: Nextcloud Server

Nextcloud

1 product

Nextcloud Server

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Nextcloud Nextcloud Server	From 28.0.0 to 28.0.10
Nextcloud Nextcloud Server	From 29.0.0 to 29.0.7
Nextcloud Nextcloud Server	From 28.0.0 to 28.0.10
Nextcloud Nextcloud Server	From 29.0.0 to 29.0.7

Related CWEs

CWE-328

Use of Weak Hash

The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).

References (3)

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2q6f-gjgj-7hp4

Source: security-advisories@github.com

Vendor Advisory

https://github.com/nextcloud/server/commit/a933ba1fdba77e7d8c6b8ff400e082cf853ea46d

Source: security-advisories@github.com

Patch

https://github.com/nextcloud/server/pull/47769

Source: security-advisories@github.com

Issue Tracking

Timeline

No history available yet.