← Volver a CVEs

CVE-2016-9464

N/A

Descripcion

Nextcloud Server before 9.0.54 and 10.0.0 suffers from an improper authorization check on removing shares. The Sharing Backend as implemented in Nextcloud does differentiate between shares to users and groups. In case of a received group share, users should be able to unshare the file to themselves but not to the whole group. The previous API implementation simply unshared the file to all users in the group.

Detalles CVE

Puntuacion CVSS v3.1N/A

Publicado3/28/2017

Ultima modificacion4/20/2025

Fuentenvd

Avistamientos honeypot0

Productos afectados

nextcloud:nextcloud_server

Debilidades (CWE)

CWE-285CWE-285

Referencias

http://www.securityfocus.com/bid/97287(support@hackerone.com)

https://github.com/nextcloud/server/commit/3387e5d00fcf6b2ea6b285a091e5743f545e7202(support@hackerone.com)

https://github.com/nextcloud/server/commit/7289cb5ec0b812992ab0dfb889744b94bc0994f0(support@hackerone.com)

https://github.com/nextcloud/server/commit/a5471b4a3e3f30e99e4de39c97c0c3b3c2f1618f(support@hackerone.com)

https://github.com/nextcloud/server/commit/e2c4f4f9aa11bc92e8f2212cce73841b922187e8(support@hackerone.com)

https://hackerone.com/reports/153905(support@hackerone.com)

https://nextcloud.com/security/advisory/?id=nc-sa-2016-007(support@hackerone.com)

http://www.securityfocus.com/bid/97287(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/nextcloud/server/commit/3387e5d00fcf6b2ea6b285a091e5743f545e7202(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/nextcloud/server/commit/7289cb5ec0b812992ab0dfb889744b94bc0994f0(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/nextcloud/server/commit/a5471b4a3e3f30e99e4de39c97c0c3b3c2f1618f(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/nextcloud/server/commit/e2c4f4f9aa11bc92e8f2212cce73841b922187e8(af854a3a-2127-422b-91ae-364da2661108)

https://hackerone.com/reports/153905(af854a3a-2127-422b-91ae-364da2661108)

https://nextcloud.com/security/advisory/?id=nc-sa-2016-007(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.