PT-2020-9748 · Nextcloud+2 · Nextcloud Server+2

Published 2019-05-07 · Updated 2022-01-01 · CVE-2019-15624

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Server version 15.0.7

Description The issue is related to improper input validation, allowing group admins to create users with IDs of system folders.

Recommendations For Nextcloud Server version 15.0.7, consider restricting the ability of group admins to create new users until a fix is available. As a temporary workaround, monitor user creation activities closely to prevent potential misuse of system folder IDs.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2019-1778

CVE-2019-15624

OPENSUSE-SU-2020:0220-1

OPENSUSE-SU-2020:0229-1

OPENSUSE-SU-2020_0220-1

Affected Products

Alt Linux

Nextcloud Server

Suse

References · 23

• 🔥 https://hackerone.com/reports/508493 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2020:0220-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15624 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2020:0229-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00019.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00022.html · Vendor Advisory
• https://nextcloud.com/security/advisory/?id=NC-SA-2019-015 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15624 · Vendor Advisory
• https://suse.com/security/cve/CVE-2020-8119 · Note
• https://suse.com/security/cve/CVE-2019-15624 · Note
• https://suse.com/security/cve/CVE-2019-15613 · Note
• https://bugzilla.suse.com/1162781 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/4ZKAQ7AEGBUT5BPIHKS2AN3QK2XYBODP · Note
• https://bugzilla.suse.com/1162784 · Note
• https://t.me/cvenotify/775 · Telegram Post