CVE-2024-52520

Published Nov 15, 2024

Last updated 2 days ago

CVSS medium 5.7

Overview

Description: Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger websites than intended, to find open-graph data. It is recommended that the Nextcloud Server is upgraded to 28.0.10 or 29.0.7 and Nextcloud Enterprise Server is upgraded to 27.1.11.8, 28.0.10 or 29.0.7.
Source: security-advisories@github.com
NVD status: Received

Risk scores

CVSS 3.1

Type: Secondary
Base score: 5.7
Impact score: 3.6
Exploitability score: 2.1
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Severity: MEDIUM

Weaknesses

security-advisories@github.com: CWE-400
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-79

Hype score: Not currently trending

CVE-2024-52520 Nextcloud Server is a self hosted personal cloud system. Due to a pre-flighted HEAD request, the link reference provider could be tricked into downloading bigger webs… https://t.co/phgWCbdS5f
@CVEnew
15 Nov 2024
193 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes

References