TI-2024-35181 Aliases CVE-2024-52510

Nextcloud Desktop client behaves incorrectly if the initial end-to-end-encryption signature is empty

LOW 34CWE-295Published 2024-11-15 · Updated 2024-11-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-295.

Summary

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed by-passing the signature validation, if a manipulated server sends an empty initial signature. It is recommended that the Nextcloud Desktop client is upgraded to 3.14.2 or later.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00783 56th percentileScored 2026-11-07

Fix Fixed security-advisories (nextcloud): 3.14.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
nextcloud	security-advisories	3.0.0 to before 3.14.2	3.14.2	Patch available	CNA

security-advisories Vendornextcloud Affected 3.0.0 to before 3.14.2 Fixed in 3.14.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:nextcloud:desktop::::::::	3.0.0 to before 3.14.2	Vulnerable	nextcloud

cpe:2.3:a:nextcloud:desktop:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.14.2 Vulnerable ·nextcloud

Remediation

Fix · CNA security-advisories (nextcloud) Fixed in 3.14.2

Timeline

2026-10-02 Threatist record created from CVE-2024-52510

References

Patch 2

Advisory 1

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r4qc-m9mj-452v

Other 1

https://hackerone.com/reports/2597504

TI-2022-18709 Cross-site scripting (XSS) in Nextcloud Desktop Client CVSS 3.1MEDIUM 6.1
TI-2022-18708 Cross-site scripting (XSS) in Nextcloud Desktop Client CVSS 3.1MEDIUM 5.4
TI-2022-18707 Cross-site Scripting (XSS) in Nexcloud Desktop Client CVSS 3.1MEDIUM 5.4
TI-2022-18710 nextcloudcmd incorrectly trusts bad TLS certificates CVSS 3.1MEDIUM 4.7
TI-2020-06645 Path traversal in Desktop Client CVSS 3.1MEDIUM 6.8
TI-2021-05740 Injection in Nextcloud Desktop Client CVSS 3.1HIGH 8.8

See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences