Reversible One-Way Hash in Nextcloud Server and Nextcloud Enterprise Server - CVE-2024-52521

Vulnerability details

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the MD5 hashes are used to check background jobs for their uniqueness. A remote user can cause potential hash collision for background jobs to skip queuing them.

Affected software

How to mitigate CVE-2024-52521

External References

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2q6f-gjgj-7hp4
• https://github.com/nextcloud/server/pull/47769
• https://github.com/nextcloud/server/commit/a933ba1fdba77e7d8c6b8ff400e082cf853ea46d

Related Security Bulletins

• Reversible One-Way Hash in Nextcloud Server and Enterprise Server