CVE-2024-52510

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed by-passing the signature validation, if a manipulated server sends an empty initial signature. It is recommended that the Nextcloud Desktop client is upgraded to 3.14.2 or later.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.2 MEDIUM
NETWORK
HIGH
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
GitHub_MCNA
4.2 MEDIUM
NETWORK
HIGH
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 63%
VendorProductVersion
nextclouddesktop
3.0.0 ≤
𝑥
< 3.14.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
nextcloud-desktop
bullseye
ignored
bookworm
ignored
bullseye (security)
vulnerable
trixie
3.16.7-1~deb13u1
fixed
forky
4.0.1-2
fixed
sid
4.0.1-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
nextcloud-desktop
questing
needs-triage
plucky
needs-triage
oracular
ignored
noble
needs-triage
jammy
needs-triage
focal
needs-triage
Common Weakness Enumeration
References
https://github.com/nextcloud/desktop/commit/97539218e6f63c3a3fd1694cb7d8aef27c5910d7
https://github.com/nextcloud/desktop/pull/7333
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r4qc-m9mj-452v
https://hackerone.com/reports/2597504