{"cve":"CVE-2024-52508","nvd":{"published":"2024-11-15T18:15:29.060","modified":"2026-06-17T08:07:21.377","status":"Analyzed","description":"Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. When a user is trying to set up a mail account with an email address like user@example.tld that does not support auto configuration, and an attacker managed to register autoconfig.tld, the used email details would be send to the server of the attacker. It is recommended that the Nextcloud Mail app is upgraded to 1.14.6, 1.15.4, 2.2.11, 3.6.3, 3.7.7 or 4.0.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","score":8.1},"cwes":["CWE-200"],"references":["https://github.com/nextcloud/mail/commit/a84c70e15d814dab6f0e8eda71bbaaf48152079b","https://github.com/nextcloud/mail/pull/9964","https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vmhx-hwph-q6mc","https://hackerone.com/reports/2508422"],"products":["nextcloud:mail"],"source":"nvd","synced_at":"2026-10-19T21:57:07.693694550+00:00"},"epss":{"cve":"CVE-2024-52508","score":0.0075,"percentile":0.54985,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}