PT-2020-19975 · Nextcloud+1 · Nextcloud Server+1

Published 2020-03-20 · Updated 2022-06-04 · CVE-2020-8139

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 18.0.1 Nextcloud Server versions prior to 17.0.4 Nextcloud Server versions prior to 16.0.9

Description A missing access control check in the software causes hide-download shares to be downloadable when appending /download to the URL. This issue allows unauthorized access to shared files.

Recommendations For versions prior to 18.0.1, update to version 18.0.1 or later to resolve the issue. For versions prior to 17.0.4, update to version 17.0.4 or later to resolve the issue. For versions prior to 16.0.9, update to version 16.0.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the /download endpoint until a patch is available.

Fix

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

ALT-PU-2020-3060

CVE-2020-8139

Affected Products

Alt Linux

Nextcloud Server

References · 5

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KC6HLX5SG4PZO6Y54D2LFJ4ATG76BKOP · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8139 · Security Note
• https://nextcloud.com/security/advisory/?id=NC-SA-2020-015 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8139 · Vendor Advisory
• https://hackerone.com/reports/788257 · Note