Main Vulnerability Database Vulnerabilities #VU46082

Path traversal in desktop - CVE-2020-8227

Published: August 21, 2020 / Updated: August 27, 2020

Vulnerability identifier: #VU46082

CSH Severity: Medium

CVSS v4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-8227

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote privileged user to execute arbitrary code.

Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud Server to store files outside of the dedicated sync directory.

Affected software

desktop
Gentoo Linux

How to mitigate CVE-2020-8227

Install update from vendor's website.

desktop - update to 2.6.5

External References

https://hackerone.com/reports/590319
https://nextcloud.com/security/advisory/?id=NC-SA-2020-032

Related Security Bulletins