Session Fixation in Nextcloud Server - CVE-2018-16463
Published: October 30, 2018 / Updated: July 17, 2020
Vulnerability identifier: #VU31186
CSH Severity: Low
CVSS v4: 1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-16463
CWE-ID: CWE-384
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to read and manipulate data.
A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could potentially allow an attacker to obtain access to password protected shares.
Affected software
Nextcloud Server
How to mitigate CVE-2018-16463
Install update from vendor's website.
Nextcloud Server - update to 13.0.3