CVE-2020-8293

Published: Jan 26, 2021Modified: Nov 21, 2024

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

A missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to store unlimited data in workflow rules causing load and potential DDoS on later interactions and usage with those rules.

Affected (3)

Products: Nextcloud: Nextcloud Server

Nextcloud

1 product

Nextcloud Server

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Nextcloud Nextcloud Server	Before 18.0.11
Nextcloud Nextcloud Server	From 19.0.0 to 19.0.5
Nextcloud Nextcloud Server	From 20.0.0 to 20.0.2

Related CWEs

CWE-400

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (4)

https://hackerone.com/reports/1018146

Source: support@hackerone.com

Third Party Advisory

https://nextcloud.com/security/advisory/?id=NC-SA-2021-001

Source: support@hackerone.com

Broken LinkVendor Advisory

https://hackerone.com/reports/1018146

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://nextcloud.com/security/advisory/?id=NC-SA-2021-001

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkVendor Advisory

Timeline

No history available yet.