PT-2016-7316 · Owncloud+1 · Owncloud Server+1

Frans Rosén + 1 · Publicado 2016-09-17 · Atualizado 2017-04-07 · CVE-2016-7419

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 9.0.4 Nextcloud Server versions prior to 9.0.52

Description A cross-site scripting (XSS) issue exists in the gallery application of ownCloud and Nextcloud servers, specifically in the share.js file. This allows remote authenticated users to inject arbitrary web script or HTML via a crafted directory name.

Recommendations For ownCloud Server versions prior to 9.0.4, update to version 9.0.4 or later. For Nextcloud Server versions prior to 9.0.52, update to version 9.0.52 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-7419

Produtos afetados

Nextcloud Server

Owncloud Server

Referências · 8

• 🔥 https://hackerone.com/reports/145355 · Exploit
• https://github.com/nextcloud/gallery/commit/6933d27afe518967bd1b60e6a7eacd88288929fc · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7419 · Nota
• http://securityfocus.com/bid/92373 · Nota
• https://owncloud.org/security/advisory/?id=oc-sa-2016-011 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-7419 · Aviso do Fabricante
• https://nextcloud.com/security/advisory/?id=nc-sa-2016-001 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-7419 · Nota de Segurança