CVE-2017-0887

Published: Apr 5, 2017Modified: May 13, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Nextcloud Server before 9.0.55 and 10.0.2 suffers from a bypass in the quota limitation. Due to not properly sanitizing values provided by the `OC-Total-Length` HTTP header an authenticated adversary may be able to exceed their configured user quota. Thus using more space than allowed by the administrator.

Affected (2)

Products: Nextcloud: Nextcloud Server

1 product

Nextcloud Server

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Nextcloud Nextcloud Server	Before 9.0.55
Nextcloud Nextcloud Server	From 10.0.0 to 10.0.2

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Reliance on Untrusted Inputs in a Security Decision

The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

References (4)

https://hackerone.com/reports/173622

Source: support@hackerone.com

Third Party Advisory

https://nextcloud.com/security/advisory/?id=nc-sa-2017-005

Source: support@hackerone.com

Broken LinkPatchVendor Advisory

https://hackerone.com/reports/173622

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://nextcloud.com/security/advisory/?id=nc-sa-2017-005

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkPatchVendor Advisory

Timeline

No history available yet.