CVE-2020-8121

Published: Feb 4, 2020Modified: Nov 21, 2024

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: NVD

Description

A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer.

Affected (3)

Products: Nextcloud: Nextcloud Server

1 product

Nextcloud Server

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Nextcloud Nextcloud Server	Before 13.0.9
Nextcloud Nextcloud Server	From 14.0.0 to 14.0.5
Nextcloud Nextcloud Server	From 14.0.6 to 15.0.0

Related CWEs

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

References (4)

https://hackerone.com/reports/452854

Source: support@hackerone.com

ExploitThird Party Advisory

https://nextcloud.com/security/advisory/?id=NC-SA-2019-003

Source: support@hackerone.com

Vendor Advisory

https://hackerone.com/reports/452854

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://nextcloud.com/security/advisory/?id=NC-SA-2019-003

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.