CVE-2019-15624 : Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to crea

Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders.

Published 2020-02-04 20:15:13

Updated 2022-01-01 20:03:41

Source HackerOne

View at NVD, CVE.org

Vulnerability category: Input validation

Products affected by CVE-2019-15624

Suse » Suse Linux Enterprise Server » Version: 12
cpe:2.3:o:suse:suse_linux_enterprise_server:12:-:*:*:*:*:*:*
Matching versions
Opensuse » Backports » Version: Sle-15 Update SP1
cpe:2.3:o:opensuse:backports:sle-15:sp1:*:*:*:*:*:*
Matching versions
Nextcloud » Nextcloud Server
Versions from including (>=) 15.0.0 and before (<) 15.0.8
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
Matching versions
Nextcloud » Nextcloud Server
Versions before (<) 14.0.11
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.16%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 53 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:N/I:P/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
4.9	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N	1.2	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00022.html

[security-announce] openSUSE-SU-2020:0229-1: moderate: Security update f
Mailing List;Third Party Advisory

CVEs referencing this url
https://hackerone.com/reports/508493

#508493 Group admins can remove arbitrary data from "data" directory (including admin data)
Exploit;Third Party Advisory
https://nextcloud.com/security/advisory/?id=NC-SA-2019-015

advisory – Nextcloud
Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00019.html

[security-announce] openSUSE-SU-2020:0220-1: moderate: Security update f
Mailing List;Third Party Advisory

CVEs referencing this url

Jump to