Lucene search
Carl PearsonNC-SA-2018-001HistoryFeb 07, 2018 - 12:00 a.m.
App password scope can be changed for other users (NC-SA-2018-001)
2018-02-0700:00:00
Carl Pearson
nextcloud.com
8
EPSS
0.001
Percentile
21.7%
A missing ownership check allowed logged-in users to change the scope of app passwords of other users. Note that the app passwords themselves where neither disclosed nor could the error be misused to identify as another user.
Related
prion
prion
Authorization
2018-03-28 20:29:00
cve
cve
CVE-2017-0936
2018-03-28 20:29:00
openvas
openvas
Nextcloud Server Authorization Bypass Vulnerability (May 2018) - Windows
2018-05-02 00:00:00
Nextcloud Server Authorization Bypass Vulnerability (May 2018) - Linux
2018-05-02 00:00:00
cvelist
cvelist
CVE-2017-0936
2018-03-28 20:00:00
nvd
nvd
CVE-2017-0936
2018-03-28 20:29:00
hackerone
hackerone
Nextcloud: Registered users can change app password permissions for any user
2017-12-14 04:42:47
osv
osv
CVE-2017-0936
2018-03-28 20:29:00
nessus
nessus
openSUSE Security Update : nextcloud (openSUSE-2018-384)
2018-04-23 00:00:00