CVE-2016-9461

2017-03-2802:46:00

CWE-275

hackerone

www.cve.org

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

44.9%

JSON

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was not properly checking the permission on a WebDAV COPY action. This allowed an authenticated attacker with access to a read-only share to put new files in there. It was not possible to modify existing files.

CNA Affected

[
  {
    "product": "Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4"
      }
    ]
  }
]