CVE-2016-9460 : Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.

Published 2017-03-28 02:59:01

Updated 2017-04-04 01:59:02

Source HackerOne

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Products affected by CVE-2016-9460

Owncloud » Owncloud
Versions up to, including, (<=) 9.0.3
cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*
Matching versions
Nextcloud » Nextcloud
Versions up to, including, (<=) 9.0.51
cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2016-9460

EPSS FAQ

0.40%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 70 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-9460

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
5.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

CWE ids for CVE-2016-9460

CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Assigned by: nvd@nist.gov (Primary)
CWE-451 User Interface (UI) Misrepresentation of Critical Information

The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

Assigned by: support@hackerone.com (Secondary)

References for CVE-2016-9460

https://owncloud.org/security/advisory/?id=oc-sa-2016-013

Security Advisories – ownCloud
Patch;Vendor Advisory
https://nextcloud.com/security/advisory/?id=nc-sa-2016-003

advisory – Nextcloud
Patch;Vendor Advisory
http://www.securityfocus.com/bid/97282

ownCloud and NextCloud CVE-2016-9460 Content Spoofing Vulnerability
https://github.com/owncloud/core/commit/c92c234059f8b1dc7d53122985ec0d398895a2cf

Ignore invalid paths in the JS file list (#25368) · owncloud/core@c92c234 · GitHub
Issue Tracking;Patch;Third Party Advisory
https://hackerone.com/reports/145463

#145463 Nextcloud server software: Content Spoofing
Exploit;Third Party Advisory
https://github.com/nextcloud/server/commit/dea8e29289a1b99d5e889627c2e377887f4f2983

Match on 405 · nextcloud/server@dea8e29 · GitHub
Issue Tracking;Patch;Third Party Advisory
https://github.com/nextcloud/server/commit/2da43e3751576bbc838f238a09955c4dcdebee8e

Do not allow directory traversal using "../" · nextcloud/server@2da43e3 · GitHub
Issue Tracking;Patch;Third Party Advisory
https://github.com/nextcloud/server/commit/8aa0832bd449c44ec300da4189bd8ed4e036140c

Match for /../ · nextcloud/server@8aa0832 · GitHub
Issue Tracking;Patch;Third Party Advisory

Jump to

Vulnerability Details : CVE-2016-9460

Products affected by CVE-2016-9460

Exploit prediction scoring system (EPSS) score for CVE-2016-9460

CVSS scores for CVE-2016-9460

CWE ids for CVE-2016-9460

References for CVE-2016-9460