7.5

CVE-2024-52525

Nextcloud Server User password is available in memory of the PHP process

User password is available in memory of the PHP process

Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved in the session storage (Redis or disk), but it would allow a malicious process that gains access to the memory of the PHP process, to get access to the cleartext password of the user. It is recommended that the Nextcloud Server is upgraded to 28.0.12, 29.0.9 or 30.0.2.
Mögliche Gegenmaßnahme
Server: * No workaround available
Enterprise Server: * No workaround available
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nextcloud ≫ Nextcloud Server SwEdition- Version >= 28.0.0 < 28.0.12
Nextcloud ≫ Nextcloud Server SwEditionenterprise Version >= 28.0.0 < 28.0.12
Nextcloud ≫ Nextcloud Server SwEdition- Version >= 29.0.0 < 29.0.9
Nextcloud ≫ Nextcloud Server SwEditionenterprise Version >= 29.0.0 < 29.0.9
Nextcloud ≫ Nextcloud Server SwEdition- Version >= 30.0.0 < 30.0.2
Nextcloud ≫ Nextcloud Server SwEditionenterprise Version >= 30.0.0 < 30.0.2
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Weitere Schwachstelleninformationen
SystemNextcloud
≫
Produkt Server
Version >= 28.0.0, < 28.0.12
Version >= 29.0.0, < 29.0.9
Version >= 30.0.0, < 30.0.2
SystemNextcloud
≫
Produkt Enterprise Server
Version >= 28.0.0, < 28.0.12
Version >= 29.0.0, < 29.0.9
Version >= 30.0.0, < 30.0.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.74% 0.729
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
security-advisories@github.com 1.8 0.2 1.4
CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N
CWE-312 Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.