CVE-2016-9464

Nextcloud Server before 9.0.54 and 10.0.0 suffers from an improper authorization check on removing shares. The Sharing Backend as implemented in Nextcloud does differentiate between shares to users and groups. In case of a received group share, users should be able to unshare the file to themselves but not to the whole group. The previous API implementation simply unshared the file to all users in the group.

CVSS v3.0 4.3 MEDIUM
CVSS v2.0 4.0 MEDIUM

4.3^/10

CVSS v3.0 : MEDIUM

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://nextcloud.com/security/advisory/?id=nc-sa-2016-007	Patch Vendor Advisory
https://hackerone.com/reports/153905	Exploit Third Party Advisory
https://github.com/nextcloud/server/commit/e2c4f4f9aa11bc92e8f2212cce73841b922187e8	Issue Tracking Patch Third Party Advisory
https://github.com/nextcloud/server/commit/a5471b4a3e3f30e99e4de39c97c0c3b3c2f1618f	Issue Tracking Patch Third Party Advisory
https://github.com/nextcloud/server/commit/7289cb5ec0b812992ab0dfb889744b94bc0994f0	Issue Tracking Patch Third Party Advisory
https://github.com/nextcloud/server/commit/3387e5d00fcf6b2ea6b285a091e5743f545e7202	Issue Tracking Patch Third Party Advisory
http://www.securityfocus.com/bid/97287	Third Party Advisory VDB Entry

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:nextcloud:nextcloud_server::::::::
	cpe:2.3:a:nextcloud:nextcloud_server:10.0:rc1::::::

Information

Published : 2017-03-27 19:59

Updated : 2019-10-09 16:20

NVD link : CVE-2016-9464

Mitre link : CVE-2016-9464

JSON object : View

CWE

CWE-285

Improper Authorization

Advertisement

Products Affected

nextcloud

nextcloud_server

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://nextcloud.com/security/advisory/?id=nc-sa-2016-007", "name": "https://nextcloud.com/security/advisory/?id=nc-sa-2016-007", "tags": ["Patch", "Vendor Advisory"], "refsource": "MISC"}, {"url": "https://hackerone.com/reports/153905", "name": "https://hackerone.com/reports/153905", "tags": ["Exploit", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://github.com/nextcloud/server/commit/e2c4f4f9aa11bc92e8f2212cce73841b922187e8", "name": "https://github.com/nextcloud/server/commit/e2c4f4f9aa11bc92e8f2212cce73841b922187e8", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://github.com/nextcloud/server/commit/a5471b4a3e3f30e99e4de39c97c0c3b3c2f1618f", "name": "https://github.com/nextcloud/server/commit/a5471b4a3e3f30e99e4de39c97c0c3b3c2f1618f", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://github.com/nextcloud/server/commit/7289cb5ec0b812992ab0dfb889744b94bc0994f0", "name": "https://github.com/nextcloud/server/commit/7289cb5ec0b812992ab0dfb889744b94bc0994f0", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://github.com/nextcloud/server/commit/3387e5d00fcf6b2ea6b285a091e5743f545e7202", "name": "https://github.com/nextcloud/server/commit/3387e5d00fcf6b2ea6b285a091e5743f545e7202", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/97287", "name": "97287", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Nextcloud Server before 9.0.54 and 10.0.0 suffers from an improper authorization check on removing shares. The Sharing Backend as implemented in Nextcloud does differentiate between shares to users and groups. In case of a received group share, users should be able to unshare the file to themselves but not to the whole group. The previous API implementation simply unshared the file to all users in the group."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-285"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2016-9464", "ASSIGNER": "cve-assignments@hackerone.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "acInsufInfo": false, "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}}, "publishedDate": "2017-03-28T02:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "9.0.54"}, {"cpe23Uri": "cpe:2.3:a:nextcloud:nextcloud_server:10.0:rc1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2019-10-09T23:20Z"}