PT-2018-16194 · Nextcloud+1 · Nextcloud Server+1

Zhouyuan Yang · Published 2017-09-21 · Updated 2023-02-28 · CVE-2018-3776

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 12.0.3 Nextcloud Server versions prior to 11.0.5

Description The issue is related to an improper input validator, which could allow an attacker's actions to remain unlogged in the audit log.

Recommendations For versions prior to 12.0.3, update to version 12.0.3 or later. For versions prior to 11.0.5, update to version 11.0.5 or later.

Fix

RCE

Insertion into Log File

Weakness Enumeration

CWE-20

CWE-532

Related Identifiers

ALT-PU-2017-2277

CVE-2018-3776

Affected Products

Alt Linux

Nextcloud Server

References · 9

• https://errata.altlinux.org/ALT-PU-2017-2277 · Vendor Advisory
• https://nextcloud.com/security/advisory/?id=NC-SA-2018-006 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-3776 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3775 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3776 · Security Note
• https://osv.dev/vulnerability/CVE-2018-3776 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3776 · Note
• https://packages.altlinux.org/ru/vuln/CVE-2018-3776 · Note
• https://hackerone.com/reports/232347 · Note