CVE-2016-9467
- State
- Published
- Severity
- Not scored
- Published
- Mar 28, 2017
- Updated
- Aug 6, 2024
- Reserved
- Nov 19, 2016
Description
Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.
Scores
The record has no CVSS score.
Weaknesses
- CWE-451 User Interface (UI) Misrepresentation of Critical Information (CWE-451)
Affected Products
| Product | Versions |
|---|---|
Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2n/a |
|
References
- https://github.com/nextcloud/server/commit/5dd211cc8845fd4533966bf8d7a7f2a6359ea013
- https://github.com/nextcloud/server/commit/ed0f0db5fa0aff04594cb0f973ae4c22b17a175a
- https://nextcloud.com/security/advisory/?id=nc-sa-2016-010
- https://github.com/nextcloud/server/commit/df50e967dbd27b13875625b7dd3189294619b071
- https://github.com/owncloud/core/commit/768221fcf3c526c65d85f62b0efa2da5ea00bf2d
- https://github.com/owncloud/core/commit/e7acbce27fa0ef1c6fe216ca67c72d86484919a4
- https://github.com/nextcloud/server/commit/c3ae21fef2880c9fe44e8fdbe1262ac7f9716f14
- https://hackerone.com/reports/154827
- https://github.com/nextcloud/server/commit/1352365e8bf5ea49da3dc82b1ccf7ddb659ae960
- https://github.com/nextcloud/server/commit/778ae8abd54c378fc4781394bbedc7a2ee3095e1
- https://owncloud.org/security/advisory/?id=oc-sa-2016-020
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.