Lucene search
Alx_ilH1:889243HistoryJun 02, 2020 - 11:23 a.m.
Nextcloud: Re-Sharing allows increase of privileges
2020-06-0211:23:03
alx_il
hackerone.com
19
EPSS
0.002
Percentile
56.7%
- User A shares a file/folder to user B with re-sharing permission, but readonly
- User B shares this file/folder to User C (Needs the shareapi_default_permissions set to 1 (all checkmarks off in admin panel))
- User B can add write permissions for the share to User C (User C may also be anonymous using a link)
- User C gets write access and can edit existing files
Impact
User can get write permission on read-only shared files/folders.
Related
cvelist
cvelist
CVE-2020-8223
2020-10-05 13:16:48
nextcloud
nextcloud
Re-Sharing allows increase of privileges (NC-SA-2020-029)
2020-07-16 00:00:00
prion
prion
Privilege escalation
2020-10-05 14:15:00
osv
osv
CVE-2020-8223
2020-10-05 14:15:13
nvd
nvd
CVE-2020-8223
2020-10-05 14:15:13
cve
cve
CVE-2020-8223
2020-10-05 14:15:13
openvas
openvas
Nextcloud Server < 17.0.8, 18.x < 18.0.7, 19.0.0 Privilege Escalation Vulnerability (NC-SA-2020-029)
2020-10-30 00:00:00
Fedora: Security Advisory for nextcloud (FEDORA-2020-050aaa14f7)
2020-10-24 00:00:00
Fedora: Security Advisory for nextcloud (FEDORA-2020-c9863904de)
2020-10-21 00:00:00
fedora
fedora
[SECURITY] Fedora 33 Update: nextcloud-19.0.3-1.fc33
2020-10-23 22:24:15
[SECURITY] Fedora 32 Update: nextcloud-18.0.9-1.fc32
2020-10-19 16:58:39
nessus
nessus
Fedora 33 : nextcloud (2020-050aaa14f7)
2020-10-26 00:00:00
Fedora 32 : nextcloud (2020-c9863904de)
2020-10-20 00:00:00