Skip to content
CVE PROGRAM SOURCE RECORD4.2 Medium

CVE-2024-52510

Nextcloud Desktop client behaves incorrectly if the initial end-to-end-encryption signature is empty

Description

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed by-passing the signature validation, if a manipulated server sends an empty initial signature. It is recommended that the Nextcloud Desktop client is upgraded to 3.14.2 or later.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

nextcloud security-advisories

  • >= 3.0.0, < 3.14.2affected

References