CVE-2024-52513

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 28.0.11 Nextcloud Server versions prior to 29.0.8 Nextcloud Server versions prior to 30.0.1 Nextcloud Enterprise Server versions prior to 25.0.13.13 Nextcloud Enterprise Server versions prior to 26.0.13.9 Nextcloud Enterprise Server versions prior to 27.1.11.9 Nextcloud Enterprise Server versions prior to 28.0.11 Nextcloud Enterprise Server versions prior to 29.0.8 Nextcloud Enterprise Server versions prior to 30.0.1

Description The issue allows a malicious user to download attachments referenced in text files without providing a password after receiving a "Files drop" or "Password protected" share link.

Recommendations Upgrade Nextcloud Server to version 28.0.11 Upgrade Nextcloud Server to version 29.0.8 Upgrade Nextcloud Server to version 30.0.1 Upgrade Nextcloud Enterprise Server to version 25.0.13.13 Upgrade Nextcloud Enterprise Server to version 26.0.13.9 Upgrade Nextcloud Enterprise Server to version 27.1.11.9 Upgrade Nextcloud Enterprise Server to version 28.0.11 Upgrade Nextcloud Enterprise Server to version 29.0.8 Upgrade Nextcloud Enterprise Server to version 30.0.1