CVE-2020-8150 : A cryptographic issue in Nextcloud Server 19.0.1 allowed an attacker to downgrade the encryption scheme and break the in

A cryptographic issue in Nextcloud Server 19.0.1 allowed an attacker to downgrade the encryption scheme and break the integrity of encrypted files.

Published 2020-11-09 15:15:13

Updated 2022-05-24 17:13:32

Source HackerOne

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2020-8150

Probability of exploitation activity in the next 30 days: 0.05%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 19 % EPSS Score History EPSS FAQ

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
1.9	LOW	AV:L/AC:M/Au:N/C:N/I:P/A:N	3.4	2.9	NIST
Access Vector: Local Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
4.1	MEDIUM	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N	0.5	3.6	NIST
Attack Vector: Local Attack Complexity: High Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE-310

Assigned by: support@hackerone.com (Secondary)
CWE-311 Missing Encryption of Sensitive Data

The product does not encrypt sensitive or critical information before storage or transmission.

Assigned by: nvd@nist.gov (Primary)

https://hackerone.com/reports/742588

HackerOne
Exploit;Third Party Advisory
http://seclists.org/fulldisclosure/2020/Dec/58

Full Disclosure: Re: CVE-2020-8150 – Remote Code Execution as SYSTEM/root via Backblaze
Mailing List;Third Party Advisory

CVEs referencing this url
http://seclists.org/fulldisclosure/2020/Dec/55

Full Disclosure: Re: [FD] CVE-2020-8150 – Remote Code Execution as SYSTEM/root via Backblaze
Mailing List;Third Party Advisory
https://nextcloud.com/security/advisory/?id=NC-SA-2020-039

advisory – Nextcloud
Vendor Advisory
http://seclists.org/fulldisclosure/2020/Dec/57

Full Disclosure: Re: [FD] CVE-2020-8150 – Remote Code Execution as SYSTEM/root via Backblaze
Mailing List;Third Party Advisory

CVEs referencing this url

Nextcloud » Nextcloud Server
Versions before (<) 19.0.2
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
Matching versions