PT-2017-10684 · Nextcloud · Nextcloud Server

Publicado 2017-04-05 · Atualizado 2019-10-09 · CVE-2017-0883

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 9.0.55 Nextcloud Server versions prior to 10.0.2

Description A permission related issue within the OCS sharing API allows an authenticated adversary to reshare shared files with an increasing permission set. This may allow an attacker to edit files in a share despite having only a 'read' permission set. The issue only affects folders and files that the adversary has at least read-only permissions for.

Recommendations For Nextcloud Server versions prior to 9.0.55, update to version 9.0.55 or later. For Nextcloud Server versions prior to 10.0.2, update to version 10.0.2 or later.

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-275

CWE-732

Identificadores relacionados

CVE-2017-0883

Produtos afetados

Nextcloud Server

Referências · 5

• https://nextcloud.com/security/advisory/?id=nc-sa-2017-001 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-0883 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-0883 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0883 · Nota
• https://hackerone.com/reports/169680 · Nota