CVE-2019-15620

EPSS 0.16%
Veröffentlicht 04.02.2020 20:15:12
Zuletzt bearbeitet 21.11.2024 04:29:08
Quelle support@hackerone.com
CVE-Watchlists
Login
Unerledigt
Login

Improper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private conversations when linked them to another shared item via the projects feature.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 5

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Nextcloud ≫ Talk Version < 6.0.4

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.16%	0.376

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	2.7	1.2	1.4	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
nvd@nist.gov	4	8	2.9	AV:N/AC:L/Au:S/C:P/I:N/A:N

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

https://hackerone.com/reports/662218

Permissions Required

https://nextcloud.com/security/advisory/?id=NC-SA-2020-011

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-15620

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-15620

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-15620

EUVD