PT-2020-19988 · Nextcloud · Groupfolders

Francesco Moro + 1 · Published 2020-05-12 · Updated 2022-05-24 · CVE-2020-8153

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Groupfolders app version 4.0.3

Description The issue is related to improper access control, allowing unauthorized deletion of hidden directories. This occurs when renaming an accessible item to the same name as a hidden directory in the Groupfolders app.

Recommendations For version 4.0.3, update to a newer version that addresses the improper access control issue to prevent unauthorized deletion of hidden directories.

Exploit

Fix

Improper Access Control

Incorrect Permission

Weakness Enumeration

CWE-284

CWE-732

Related Identifiers

CVE-2020-8153

Affected Products

Groupfolders

References · 5

• 🔥 https://hackerone.com/reports/642515 · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KC6HLX5SG4PZO6Y54D2LFJ4ATG76BKOP · Vendor Advisory
• https://nextcloud.com/security/advisory/?id=NC-SA-2020-017 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8153 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8153 · Security Note