CVE-2016-9461: falha em Nextcloud Server & ownCloud Server Nextcloud…
Publicada em · Atualizada em
Seguir esta CVE+ Monitorar Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Server
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 2.0%
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was not properly checking the permission on a WebDAV COPY action. This allowed an authenticated attacker with access to a read-only share to put new files in there. It was not possible to modify existing files.
Produtos afetados
n/a · Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4Referências
https://github.com/nextcloud/server/commit/3491400261c1454a9a30d3ec96969573330120cchttps://github.com/owncloud/core/commit/0622e635d97cb17c5e1363e370bb8268cc3d2547https://github.com/owncloud/core/commit/121a3304a0c37ccda0e1b63ddc528cba9121a36ehttps://github.com/owncloud/core/commit/acbbadb71ceee7f01da347f7dcd519beda78cc47https://github.com/owncloud/core/commit/c0a4b7b3f38ad2eaf506484b3b92ec678cb021c9https://hackerone.com/reports/145950https://nextcloud.com/security/advisory/?id=nc-sa-2016-004https://owncloud.org/security/advisory/?id=oc-sa-2016-014http://www.securityfocus.com/bid/97276