CVE-2017-0887

MEDIUM

4.3

Description

Nextcloud Server before 9.0.55 and 10.0.2 suffers from a bypass in the quota limitation. Due to not properly sanitizing values provided by the `OC-Total-Length` HTTP header an authenticated adversary may be able to exceed their configured user quota. Thus using more space than allowed by the administrator.

Details CVE

Score CVSS v3.14.3

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisLOW

Interaction utilisateurNONE

Publie4/5/2017

Derniere modification4/20/2025

Sourcenvd

Observations honeypot0

Produits affectes

nextcloud:nextcloud_server

Faiblesses (CWE)

CWE-807CWE-20

References

https://hackerone.com/reports/173622(support@hackerone.com)

https://nextcloud.com/security/advisory/?id=nc-sa-2017-005(support@hackerone.com)

https://hackerone.com/reports/173622(af854a3a-2127-422b-91ae-364da2661108)

https://nextcloud.com/security/advisory/?id=nc-sa-2017-005(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.