Skip to content
OpenAdvisories
Medium WID-SEC-2025-1082 5 CVEs

Nextcloud: Mehrere Schwachstellen

Published May 15, 2025 · Updated May 18, 2025 · Revision 2 · de-DE

Vendor: Nextcloud Product: Nextcloud Platform: Windows

Summary

Ein entfernter authentisierter Angreifer oder ein Angreifer aus einem angrenzenden Netzwerk kann mehrere Schwachstellen in Nextcloud ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen preiszugeben, Daten zu manipulieren und einen Denial-of-Service-Zustand zu verursachen.

Product

Nextcloud ist eine "on-premise" Plattform für Dateifreigabe und Zusammenarbeit.

Vulnerabilities 5

  • Medium 6.4
    CVE-2025-47790

    Nextcloud Server doesn't request second factor after session timeout

    Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, and 31.0.3 have a bug with session handling. The bug ca…

    Nextcloud security-advisories
  • Medium 5.0
    CVE-2025-47792

    Nextcloud Desktop 3rdparty applications can create share links via socket API

    Nextcloud Desktop is the desktop sync client for Nextcloud. In versions of Nextcloud Desktop prior to 3.15, 3rdparty applications already installed on a user machine can create link shares for almost all data via the socket API. These shares can then be easil…

    Nextcloud security-advisories nextcloud-desktop nextcloud-desktop Debian Ubuntu
  • Medium 4.3
    CVE-2025-47791

    Nextcloud Server's test remote endpoint is not rate limited

    Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 28.0.13, 29.0.10, and 30.0.3 and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3, a currently unused endpoint to verify a share recipient was not protected…

    Nextcloud security-advisories
  • Medium 4.3
    CVE-2025-47793

    Nextcloud Server and Groupfolders app vulnerable to bypass of group folder quota limit using attachment in text file

    Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team. In Nextcloud Server prior to 30.0.2, 29.0.9, and 28.0.1, Nextcloud Enterprise Server prior to …

    Nextcloud security-advisories
  • Low 2.6
    CVE-2025-47794

    Nextcloud Server vulnerable to insecure temporary file creation, race with write access and permission

    Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Nextcloud Enterprise Server prior to 26.0.13.13, 27.1.11.13, 28.0.14.4, 29.0.13, 30.0.7, and 31.0.1, an attacker on a multi-user system may r…

    Nextcloud security-advisories

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2025-15457, EUVD-2025-15456, EUVD-2025-15453, EUVD-2025-15452

  2. #1

    Initiale Fassung

References