PT-2020-9747 · Nextcloud+2 · Nextcloud Server+2

Leon Klingele · Published 2020-02-04 · Updated 2021-10-29 · CVE-2019-15623

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Server version 16.0.1

Description The issue causes the server to send its domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled. This results in the exposure of private information.

Recommendations For Nextcloud Server version 16.0.1, consider disabling the Lookup server feature to prevent the exposure of private information until a patch is available. Restrict access to sensitive data to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-359

Related Identifiers

ALT-PU-2020-3060

CVE-2019-15623

OPENSUSE-SU-2020:0220-1

OPENSUSE-SU-2020:0229-1

OPENSUSE-SU-2020_0220-1

Affected Products

Alt Linux

Nextcloud Server

Suse

References · 24

• 🔥 https://hackerone.com/reports/508490 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2020:0220-1 · Vendor Advisory
• https://nextcloud.com/security/advisory/?id=NC-SA-2019-016 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15623 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2020:0229-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15623 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00019.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00022.html · Vendor Advisory
• https://suse.com/security/cve/CVE-2020-8119 · Note
• https://suse.com/security/cve/CVE-2019-15624 · Note
• https://suse.com/security/cve/CVE-2019-15613 · Note
• https://bugzilla.suse.com/1162781 · Note
• https://t.me/cvenotify/774 · Telegram Post
• https://lists.opensuse.org/archives/list/[e-mail]/thread/4ZKAQ7AEGBUT5BPIHKS2AN3QK2XYBODP · Note
• https://bugzilla.suse.com/1162784 · Note