CVE-2024-52521CWE-328

Nextcloud Server has a potential hash collision for background jobs could skip queuing them

Low · published November 15, 2024

CVSS v3.1
2.6
EPSS
0%
Percentile
32.7
In the wild
Unconfirmed
What it is

Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely being identified as already existing and not be queued for execution. By changing the Hash to SHA256 the probability was heavily decreased. It is recommended that the Nextcloud Server is upgraded to 28.0.10, 29.0.7 or 30.0.0.

The record
Technical detail
CVSS v3.1
2.6 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00397 · 32.7th percentile
Weakness
CWE-328 · Use of Weak Hash
Published
2024-11-15T16:38Z
EPSS history
Timeline
  • 15 NOV 16:38Z
    Nextcloud Server has a potential hash collision for background jobs could skip queuing them
    cvelistv5