SB2020082723 - Multiple vulnerabilities in Nextcloud Desktop client

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Cross-site scripting (CVE-ID: CVE-2020-8189)

The vulnerability allows a remote authenticated user to read and manipulate data.

A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invalid data on the login attempt.

2) Path traversal (CVE-ID: CVE-2020-8227)

The vulnerability allows a remote privileged user to execute arbitrary code.

Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud Server to store files outside of the dedicated sync directory.

Remediation

Install update from vendor's website.

References

• https://hackerone.com/reports/685552
• https://nextcloud.com/security/advisory/?id=NC-SA-2020-027
• https://hackerone.com/reports/590319
• https://nextcloud.com/security/advisory/?id=NC-SA-2020-032