CVE-2017-0885

Published: Apr 5, 2017Modified: May 13, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Nextcloud Server before 9.0.55 and 10.0.2 suffers from a error message disclosing existence of file in write-only share. Due to an error in the application logic an adversary with access to a write-only share may enumerate the names of existing files and subfolders by comparing the exception messages.

Affected (2)

Products: Nextcloud: Nextcloud Server

1 product

Nextcloud Server

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Nextcloud Nextcloud Server	Before 9.0.55
Nextcloud Nextcloud Server	From 10.0.0 to 10.0.2

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.

References (4)

https://hackerone.com/reports/174524

Source: support@hackerone.com

Third Party Advisory

https://nextcloud.com/security/advisory/?id=nc-sa-2017-003

Source: support@hackerone.com

Broken LinkPatchVendor Advisory

https://hackerone.com/reports/174524

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://nextcloud.com/security/advisory/?id=nc-sa-2017-003

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkPatchVendor Advisory

Timeline

No history available yet.