PT-2020-9745 · Nextcloud+2 · Nextcloud Server+2

Published 2020-02-04 · Updated 2020-10-15 · CVE-2019-15621

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Server version 16.0.1

Description The issue is related to improper permissions preservation, allowing sharees to reshare with write permissions when sharing the mount point of a share they received as a public link.

Recommendations For Nextcloud Server version 16.0.1, consider restricting the ability to reshare mounts of received shares to prevent unauthorized write access until a patch is available.

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

ALT-PU-2020-3060

CVE-2019-15621

OPENSUSE-SU-2020:0220-1

OPENSUSE-SU-2020:0229-1

OPENSUSE-SU-2020_0220-1

Affected Products

Alt Linux

Nextcloud Server

Suse

References · 23

• https://osv.dev/vulnerability/openSUSE-SU-2020:0220-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0229-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15621 · Security Note
• https://nextcloud.com/security/advisory/?id=NC-SA-2020-012 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15621 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00019.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00022.html · Vendor Advisory
• https://t.me/cvenotify/772 · Telegram Post
• https://suse.com/security/cve/CVE-2020-8119 · Note
• https://suse.com/security/cve/CVE-2019-15624 · Note
• https://suse.com/security/cve/CVE-2019-15613 · Note
• https://bugzilla.suse.com/1162781 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/4ZKAQ7AEGBUT5BPIHKS2AN3QK2XYBODP · Note
• https://bugzilla.suse.com/1162784 · Note
• https://suse.com/security/cve/CVE-2019-15621 · Note