CVE-2016-9460

2017-03-2802:59:00

Google

osv.dev

6.6 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

73.7%

JSON

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.

CPENameOperatorVersion
servereq4.0.6
servereq4.5.0beta2
servereq6.0.0beta3
servereq9.0beta1
servereq9.0.0beta2
servereq2.0beta3
servereq6.0.0RC2
servereq1.0.0beta1
servereq4.0.0RC
servereq8.0.0beta1

Name	Operator	Version
server	eq	4.0.6
server	eq	4.5.0beta2
server	eq	6.0.0beta3
server	eq	9.0beta1
server	eq	9.0.0beta2
server	eq	2.0beta3
server	eq	6.0.0RC2
server	eq	1.0.0beta1
server	eq	4.0.0RC
server	eq	8.0.0beta1