VulnerabilityAnalyzed

CVE-2024-52509

The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments.

MEDIUM 5.7EPSS 0.51%

Does this matter?

Lower severity and a low EPSS score (0.51%). Track it; it rarely justifies an emergency change on its own.

Description

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments. This allowed users to send them the files to themselves and then downloading it from their mail clients. It is recommended that the Nextcloud Mail is upgraded to 2.2.10, 3.6.2 or 3.7.2.

CVSS 3.1: 5.7 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
EPSS: 0.51% probability · 42th percentile
CISA KEV: Not listed
Weakness: CWE-284
Affected: nextcloud/mail
Source: security-advisories@github.com

References

https://github.com/nextcloud/mail/commit/8d44f1ce44684022aa4e62a3e0462fdadcde6c8bPatch
https://github.com/nextcloud/mail/pull/9592Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pwpp-fvcr-w862Patch, Vendor Advisory
https://hackerone.com/reports/1878255Issue Tracking

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.