CVE-2016-9460

2017-03-2802:46:00

CWE-451

hackerone

www.cve.org

5.4 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.7%

JSON

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.

CNA Affected

[
  {
    "product": "Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4"
      }
    ]
  }
]