Nextcloud Mail up to 2.2.9/3.6.1/3.7.1 access control

Summaryinfo

A vulnerability was found in Nextcloud Mail up to 2.2.9/3.6.1/3.7.1. It has been classified as critical. This impacts an unknown function. This manipulation causes access control. This vulnerability is handled as CVE-2024-52509. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Nextcloud Mail up to 2.2.9/3.6.1/3.7.1. It has been declared as problematic. Affected by this vulnerability is an unknown code block. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. As an impact it is known to affect confidentiality. The summary by CVE is:

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments. This allowed users to send them the files to themselves and then downloading it from their mail clients. It is recommended that the Nextcloud Mail is upgraded to 2.2.10, 3.6.2 or 3.7.2.

The advisory is shared at github.com. This vulnerability is known as CVE-2024-52509 since 11/11/2024. The exploitation appears to be easy. The attack can be launched remotely. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading to version 2.2.10, 3.6.2 or 3.7.2 eliminates this vulnerability. Applying the patch 8d44f1ce44684022aa4e62a3e0462fdadcde6c8b is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Cloud Software

Vendor

• Nextcloud

Name

• Mail

Version

• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3
• 2.2.4
• 2.2.5
• 2.2.6
• 2.2.7
• 2.2.8
• 2.2.9
• 3.6.0
• 3.6.1
• 3.7.0
• 3.7.1

License

• open-source

Website

• Product: https://github.com/nextcloud/mail/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion