CVE-2024-52525

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 28.0.12 Nextcloud Server versions prior to 29.0.9 Nextcloud Server versions prior to 30.0.2

Description: The issue concerns the storage of user passwords in unencrypted form in session data under certain conditions. Although the session data is encrypted before being saved, a malicious process gaining access to the PHP process memory could obtain the cleartext password.

Recommendations: For versions prior to 28.0.12, upgrade to 28.0.12. For versions prior to 29.0.9, upgrade to 29.0.9. For versions prior to 30.0.2, upgrade to 30.0.2. As a temporary workaround, consider restricting access to sensitive data until the upgrade is applied.