PT-2017-10687 · Nextcloud · Nextcloud Server

Published 2017-04-05 · Updated 2022-10-04 · CVE-2017-0886

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 9.0.55 Nextcloud Server versions prior to 10.0.2

Description The issue allows an authenticated adversary to trigger an endless recursion in the application, leading to a potential Denial of Service attack due to an error in the application logic.

Recommendations For versions prior to 9.0.55, update to version 9.0.55 or later. For versions prior to 10.0.2, update to version 10.0.2 or later.

Fix

DoS

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2017-0886

Affected Products

Nextcloud Server

References · 5

• https://osv.dev/vulnerability/CVE-2017-0886 · Vendor Advisory
• https://nextcloud.com/security/advisory/?id=nc-sa-2017-004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-0886 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0886 · Note
• https://hackerone.com/reports/174524 · Note