PT-2017-10684 · Nextcloud · Nextcloud Server

Published 2017-04-05 · Updated 2019-10-09 · CVE-2017-0883

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 9.0.55 Nextcloud Server versions prior to 10.0.2

Description A permission related issue within the OCS sharing API allows an authenticated adversary to reshare shared files with an increasing permission set. This may allow an attacker to edit files in a share despite having only a 'read' permission set. The issue only affects folders and files that the adversary has at least read-only permissions for.

Recommendations For Nextcloud Server versions prior to 9.0.55, update to version 9.0.55 or later. For Nextcloud Server versions prior to 10.0.2, update to version 10.0.2 or later.

Fix

Incorrect Permission

Weakness Enumeration

CWE-275

CWE-732

Related Identifiers

CVE-2017-0883

Affected Products

Nextcloud Server

References · 5

• https://nextcloud.com/security/advisory/?id=nc-sa-2017-001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-0883 · Security Note
• https://osv.dev/vulnerability/CVE-2017-0883 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0883 · Note
• https://hackerone.com/reports/169680 · Note