Server: Incorrect setup of external storage

ID OC-SA-2016-009
Type owncloud
Reporter ownCloud
Modified 2016-07-13T02:00:00


The external storage functionality as implemented in ownCloud 9.0.x before 9.0.2 is improperly setting up external storages when multiple groups have been granted access to an external storage and a user is member of both groups.

The storage class is setup without any setup information, leading to multiple issues, including:

Unavailability of the external storage

Access to files that are not supposed to be shared (only if the 'Local' storage type is used)

For more information please consult the official advisory.

This advisory is licensed CC BY-SA 4.0