Security restrictions bypass in Nextcloud Server

1) Authorization bypass through user-controlled SQL primary key

EUVDB-ID: #VU12595

Risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-0936

CWE-ID: CWE-566 - Authorization Bypass Through User-Controlled SQL Primary Key

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to bypass security restrictions and on the target system.

The weakness exists due to authorization bypass through user-controlled key. A remote attacker can change the scope of app passwords of other users and write arbitrary files on the target system.

Mitigation

Update to versions 11.0.7 or 12.0.5.

Vulnerable software versions

Nextcloud Server: 11.0.0 - 12.0.4

CPE2.3

• cpe:2.3:a:nextcloud:nextcloud_server:11.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:nextcloud:nextcloud_server:11.0.1:*:*:*:*:*:*:*
• cpe:2.3:a:nextcloud:nextcloud_server:11.0.2:*:*:*:*:*:*:*

External links

https://nextcloud.com/security/advisory/?id=nc-sa-2018-001

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.