PT-2016-7316 · Owncloud+1 · Owncloud Server+1

Frans Rosén + 1 · Published 2016-09-17 · Updated 2017-04-07 · CVE-2016-7419

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 9.0.4 Nextcloud Server versions prior to 9.0.52

Description A cross-site scripting (XSS) issue exists in the gallery application of ownCloud and Nextcloud servers, specifically in the share.js file. This allows remote authenticated users to inject arbitrary web script or HTML via a crafted directory name.

Recommendations For ownCloud Server versions prior to 9.0.4, update to version 9.0.4 or later. For Nextcloud Server versions prior to 9.0.52, update to version 9.0.52 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-7419

Affected Products

Nextcloud Server

Owncloud Server

References · 8

• 🔥 https://hackerone.com/reports/145355 · Exploit
• https://github.com/nextcloud/gallery/commit/6933d27afe518967bd1b60e6a7eacd88288929fc · Patch
• https://owncloud.org/security/advisory/?id=oc-sa-2016-011 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-7419 · Vendor Advisory
• https://nextcloud.com/security/advisory/?id=nc-sa-2016-001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7419 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7419 · Note
• http://securityfocus.com/bid/92373 · Note