CVE-2018-3762

Published: Jul 5, 2018Modified: Nov 21, 2024

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still request previews for files it should not have access to.

Affected (2)

Products: Nextcloud: Nextcloud Server

Nextcloud

1 product

Nextcloud Server

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Nextcloud Nextcloud Server	Before 12.0.8
Nextcloud Nextcloud Server	From 13.0.0 to 13.0.3

Related CWEs

CWE-281

Improper Preservation of Permissions

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (4)

https://hackerone.com/reports/358339

Source: support@hackerone.com

Third Party Advisory

https://nextcloud.com/security/advisory/?id=nc-sa-2018-002

Source: support@hackerone.com

Broken LinkVendor Advisory

https://hackerone.com/reports/358339

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://nextcloud.com/security/advisory/?id=nc-sa-2018-002

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkVendor Advisory

Timeline

No history available yet.