CVE-2016-9459
- State
- Published
- Severity
- Not scored
- Published
- Mar 28, 2017
- Updated
- Aug 6, 2024
- Reserved
- Nov 19, 2016
Description
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download log functionality in the admin screen is delivering the log in JSON format to the end-user. The file was delivered with an attachment disposition forcing the browser to download the document. However, Firefox running on Microsoft Windows would offer the user to open the data in the browser as an HTML document. Thus any injected data in the log would be executed.
Scores
The record has no CVSS score.
Weaknesses
- CWE-209 Cross-Site Scripting Using MIME Type Mismatch (CWE-209)
Affected Products
| Product | Versions |
|---|---|
Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4n/a |
|
References
- https://owncloud.org/security/advisory?id=oc-sa-2016-012
- https://github.com/owncloud/core/commit/b7fa2c5dc945b40bc6ed0a9a0e47c282ebf043e1
- https://github.com/owncloud/core/commit/044ee072a647636b1a17c89265c7233b35371335
- https://hackerone.com/reports/146278
- https://github.com/owncloud/core/commit/efa35d621dc7ff975468e636a5d1c153511296dc
- https://nextcloud.com/security/advisory/?id=nc-sa-2016-002
- https://github.com/nextcloud/server/commit/94975af6db1551c2d23136c2ea22866a5b416070
- 97284vdb-entry
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.