Multiple vulnerabilities in Nextcloud Server



| Updated: 2020-07-18
Risk Low
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2016-9459
CVE-2016-9461
CVE-2016-9462
CWE-ID CWE-79
CWE-284
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Nextcloud Server
Client/Desktop applications / Messaging software

Vendor Nextcloud

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Cross-site scripting

EUVDB-ID: #VU31431

Risk: Low

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-9459

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download log functionality in the admin screen is delivering the log in JSON format to the end-user. The file was delivered with an attachment disposition forcing the browser to download the document. However, Firefox running on Microsoft Windows would offer the user to open the data in the browser as an HTML document. Thus any injected data in the log would be executed.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Nextcloud Server: 9.0.0 - 9.0.51

CPE2.3 External links

https://www.securityfocus.com/bid/97284
https://github.com/nextcloud/server/commit/94975af6db1551c2d23136c2ea22866a5b416070
https://github.com/owncloud/core/commit/044ee072a647636b1a17c89265c7233b35371335
https://github.com/owncloud/core/commit/b7fa2c5dc945b40bc6ed0a9a0e47c282ebf043e1
https://github.com/owncloud/core/commit/efa35d621dc7ff975468e636a5d1c153511296dc
https://hackerone.com/reports/146278
https://nextcloud.com/security/advisory/?id=nc-sa-2016-002
https://owncloud.org/security/advisory?id=oc-sa-2016-012


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper access control

EUVDB-ID: #VU31432

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-9461

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to manipulate data.

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was not properly checking the permission on a WebDAV COPY action. This allowed an authenticated attacker with access to a read-only share to put new files in there. It was not possible to modify existing files.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Nextcloud Server: 9.0.0 - 9.0.51

CPE2.3 External links

https://www.securityfocus.com/bid/97276
https://github.com/nextcloud/server/commit/3491400261c1454a9a30d3ec96969573330120cc
https://github.com/owncloud/core/commit/0622e635d97cb17c5e1363e370bb8268cc3d2547
https://github.com/owncloud/core/commit/121a3304a0c37ccda0e1b63ddc528cba9121a36e
https://github.com/owncloud/core/commit/acbbadb71ceee7f01da347f7dcd519beda78cc47
https://github.com/owncloud/core/commit/c0a4b7b3f38ad2eaf506484b3b92ec678cb021c9
https://hackerone.com/reports/145950
https://nextcloud.com/security/advisory/?id=nc-sa-2016-004
https://owncloud.org/security/advisory/?id=oc-sa-2016-014


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper access control

EUVDB-ID: #VU31433

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-9462

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to manipulate data.

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a share. Thus a user with read-only access was able to restore old versions.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Nextcloud Server: 9.0.0 - 9.0.51

CPE2.3 External links

https://www.securityfocus.com/bid/97285
https://github.com/nextcloud/server/commit/1208953ba1d4d55a18a639846bbcdd66a2d5bc5e
https://github.com/owncloud/core/commit/23383080731d092e079986464a8c4c9ffcb79f4c
https://github.com/owncloud/core/commit/3b056fa68ce502ceb0db9b446dab3b9e7b10dd13
https://github.com/owncloud/core/commit/c93eca49c32428ece03dd67042772d5fa62c8d6e
https://github.com/owncloud/core/commit/d31720b6f1e8c8dfeb5e8805ab35ad7c8000b2f1
https://hackerone.com/reports/146067
https://nextcloud.com/security/advisory/?id=nc-sa-2016-005
https://owncloud.org/security/advisory/?id=oc-sa-2016-015


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###