PT-2021-12722 · Nextcloud+2 · Nextcloud Server+2

Demonia

·

Published

2021-01-26

·

Updated

2022-09-27

·

CVE-2020-8293

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 20.0.2 Nextcloud Server versions prior to 19.0.5 Nextcloud Server versions prior to 18.0.11
Description: A missing input validation in Nextcloud Server allows users to store unlimited data in workflow rules, causing load and potential DDoS on later interactions and usage with those rules.
Recommendations: For versions prior to 20.0.2, update to version 20.0.2 or later to resolve the issue. For versions prior to 19.0.5, update to version 19.0.5 or later to resolve the issue. For versions prior to 18.0.11, update to version 18.0.11 or later to resolve the issue.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALT-PU-2021-3108
ALT-PU-2021-3224
CVE-2020-8293
OPENSUSE-SU-2021:0262-1
OPENSUSE-SU-2021:0274-1
OPENSUSE-SU-2021:1068-1
OPENSUSE-SU-2021_0262-1
OPENSUSE-SU-2021_1068-1

Affected Products

Alt Linux
Nextcloud Server
Suse