CVE-2024-52508 Nextcloud Mail auto configurator can be tricked into sending account information to wrong servers
Attackers can intercept email account credentials by registering a domain used in auto-configuration, exposing sensitive user data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-52508?
CVE-2024-52508 is a high-severity vulnerability in nextcloud security-advisories, published on 15 Nov 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. When a user is trying to set up a mail account with an email address like [email protected] that does not support auto configuration, and an attacker managed to register autoconfig.tld, the used email details would be send to the server of the attacker. It is recommended that the Nextcloud Mail app is upgraded to 1.14.6, 1.15.4, 2.2.11, 3.6.3, 3.7.7 or 4.0.0.
Weakness: CWE-200
Which versions are affected by CVE-2024-52508?
It affects 1 product.
Products include Nextcloud Mail.
How do I fix CVE-2024-52508?
No fix has been published for CVE-2024-52508 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-52508 being exploited?
There is no known exploitation of CVE-2024-52508 in the wild and no public exploit code.
Other vulnerabilities in nextcloud security-advisories
- CVE-2021-32652 Missing permission check on email metadata retrieval
- CVE-2022-31132 Unauthenticated SSRF in 3rd party module "cerdic/csstidy"
- CVE-2023-23943 Blind SSRF via server URL input in the Nextcloud Mail app
- CVE-2023-45660 Require strict cookies for image proxy requests in Nextcloud Mail
- CVE-2021-32707 Bypass of image blocking in Nextcloud Mail
Sources
Also known as GHSA-vmhx-hwph-q6mc.