CVE-2016-9462

2017-03-2802:46:00

CWE-275

hackerone

www.cve.org

4.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

49.8%

JSON

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a share. Thus a user with read-only access was able to restore old versions.

CNA Affected

[
  {
    "product": "Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4"
      }
    ]
  }
]