5.3

CVE-2016-9467

Exploit
Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nextcloud ≫ Nextcloud Server Version < 9.0.54
Nextcloud ≫ Nextcloud Server Version >= 10.0.0 < 10.0.1
Owncloud ≫ Owncloud Version >= 9.0.0 < 9.0.6
Owncloud ≫ Owncloud Version >= 9.1.0 < 9.1.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.97% 0.855
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.3 3.9 1.4
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:P/A:N
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CWE-451 User Interface (UI) Misrepresentation of Critical Information

The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

https://github.com/nextcloud/server/commit/1352365e8bf5ea49da3dc82b1ccf7ddb659ae960
Patch
Third Party Advisory
Issue Tracking
https://github.com/nextcloud/server/commit/5dd211cc8845fd4533966bf8d7a7f2a6359ea013
Patch
Third Party Advisory
Issue Tracking
https://github.com/nextcloud/server/commit/778ae8abd54c378fc4781394bbedc7a2ee3095e1
Patch
Third Party Advisory
Issue Tracking
https://github.com/nextcloud/server/commit/c3ae21fef2880c9fe44e8fdbe1262ac7f9716f14
Patch
Third Party Advisory
Issue Tracking
https://github.com/nextcloud/server/commit/df50e967dbd27b13875625b7dd3189294619b071
Patch
Third Party Advisory
Issue Tracking
https://github.com/nextcloud/server/commit/ed0f0db5fa0aff04594cb0f973ae4c22b17a175a
Patch
Third Party Advisory
Issue Tracking
https://github.com/owncloud/core/commit/768221fcf3c526c65d85f62b0efa2da5ea00bf2d
Patch
Third Party Advisory
Issue Tracking
https://github.com/owncloud/core/commit/e7acbce27fa0ef1c6fe216ca67c72d86484919a4
Patch
Third Party Advisory
Issue Tracking
https://hackerone.com/reports/154827
Third Party Advisory
Exploit
https://nextcloud.com/security/advisory/?id=nc-sa-2016-010
Patch
Vendor Advisory
https://owncloud.org/security/advisory/?id=oc-sa-2016-020
Patch
Vendor Advisory