7.7
CVE-2020-8154
- EPSS 0.96%
- Published 12.05.2020 13:15:13
- Last modified 21.11.2024 05:38:23
- Source support@hackerone.com
- Teams watchlist Login
- Open Login
An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint.
Data is provided by the National Vulnerability Database (NVD)
Nextcloud ≫ Nextcloud Server Version < 17.0.5
Nextcloud ≫ Nextcloud Server Version >= 18.0.0 < 18.0.3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.96% | 0.757 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 7.7 | 3.1 | 4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
|
| nvd@nist.gov | 6.8 | 8 | 6.9 |
AV:N/AC:L/Au:S/C:N/I:N/A:C
|
CWE-639 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.