sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2024-52525 Nextcloud Server User password is available in memory of the PHP process

Low 1.8 Published Updated

Attackers with PHP process memory access can retrieve cleartext user passwords stored in session data.

Exploited in the wild
Not known
Login needed
An administrator
Attackable
Local or same network only
Victim action needed
A user has to click or open something
Fix
None listed

What is CVE-2024-52525?

CVE-2024-52525 is a low-severity vulnerability in Nextcloud Nextcloud Server, published on 15 Nov 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved in the session storage (Redis or disk), but it would allow a malicious process that gains access to the memory of the PHP process, to get access to the cleartext password of the user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2.

Weakness: CWE-312

Which versions are affected by CVE-2024-52525?

It affects 1 product.

Products include Nextcloud Nextcloud Server.

How do I fix CVE-2024-52525?

No fix has been published for CVE-2024-52525 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-52525 being exploited?

There is no known exploitation of CVE-2024-52525 in the wild and no public exploit code.

All Nextcloud Nextcloud Server vulnerabilities

Sources

Also known as GHSA-w7v5-mgxm-v6gm.

Is CVE-2024-52525 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free