Improper access control in Nextcloud Server - CVE-2016-9467
Published: March 28, 2017 / Updated: July 18, 2020
Vulnerability identifier: #VU31430
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2016-9467
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Nextcloud
Affected software:
Nextcloud Server
Nextcloud Server
Detailed vulnerability description
The vulnerability allows a remote non-authenticated attacker to manipulate data.
Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.
How to mitigate CVE-2016-9467
Install update from vendor's website.
Sources
- https://github.com/nextcloud/server/commit/1352365e8bf5ea49da3dc82b1ccf7ddb659ae960
- https://github.com/nextcloud/server/commit/5dd211cc8845fd4533966bf8d7a7f2a6359ea013
- https://github.com/nextcloud/server/commit/778ae8abd54c378fc4781394bbedc7a2ee3095e1
- https://github.com/nextcloud/server/commit/c3ae21fef2880c9fe44e8fdbe1262ac7f9716f14
- https://github.com/nextcloud/server/commit/df50e967dbd27b13875625b7dd3189294619b071
- https://github.com/nextcloud/server/commit/ed0f0db5fa0aff04594cb0f973ae4c22b17a175a
- https://github.com/owncloud/core/commit/768221fcf3c526c65d85f62b0efa2da5ea00bf2d
- https://github.com/owncloud/core/commit/e7acbce27fa0ef1c6fe216ca67c72d86484919a4
- https://hackerone.com/reports/154827
- https://nextcloud.com/security/advisory/?id=nc-sa-2016-010
- https://owncloud.org/security/advisory/?id=oc-sa-2016-020