HIGH
An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint
Published May 12, 2020
7.7
HIGHCVSS 3.1
EPSS 1.77%
Description
An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint.
Affected products
- Vendor n/a Product Nextcloud Server Defaultunknown
Affected
- 18.0.3
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| n/a | Nextcloud Server | unknown | Affected
|
OR
- < 17.0.5
- ≥ 18.0.0 · < 18.0.3
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (8)
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00037.html vendor-advisoryx_refsource_SUSE
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00038.html vendor-advisoryx_refsource_SUSE
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00040.html vendor-advisoryx_refsource_SUSE
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00019.html vendor-advisoryx_refsource_SUSE
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-29047 Advisory
- https://hackerone.com/reports/819807 x_refsource_MISCExploitThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KC6HLX5SG4PZO6Y54D2LFJ4ATG76BKOP/ vendor-advisoryx_refsource_FEDORA
- https://nextcloud.com/security/advisory/?id=NC-SA-2020-018 x_refsource_MISCVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00037.html | vendor-advisoryx_refsource_SUSE | |
| http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00038.html | vendor-advisoryx_refsource_SUSE | |
| http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00040.html | vendor-advisoryx_refsource_SUSE | |
| http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00019.html | vendor-advisoryx_refsource_SUSE | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-29047 | Advisory | |
| https://hackerone.com/reports/819807 | x_refsource_MISCExploitThird Party Advisory | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KC6HLX5SG4PZO6Y54D2LFJ4ATG76BKOP/ | vendor-advisoryx_refsource_FEDORA | |
| https://nextcloud.com/security/advisory/?id=NC-SA-2020-018 | x_refsource_MISCVendor Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner hackerone
Published May 12, 2020
Updated Aug 4, 2024
Reserved Jan 28, 2020
Link CVE-2020-8154
CISA Vulnrichment
No data
Red Hat
No data
GitHub
No data