Vulnerabilities > CVE-2020-8154 - Authorization Bypass Through User-Controlled Key vulnerability in Nextcloud Server

047910
CVSS 7.7 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
network
low complexity
nextcloud
CWE-639
nessus
NVD
Published: 2020-05-12
Updated: 2023-11-07

Summary

An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint.

Vulnerable Configurations

Part Description Count
Application
Nextcloud
629

Common Weakness Enumeration (CWE)

Nessus

NASL familySuSE Local Security Checks
NASL idOPENSUSE-2020-670.NASL
descriptionThis update for nextcloud to 18.0.4 fixes the following issues : Security issues fixed : - CVE-2020-8154: Fixed an XSS vulnerability when opening malicious PDFs (NC-SA-2020-018 boo#1171579). - CVE-2020-8155: Fixed a direct object reference vulnerability that allowed attackers to remotely wipe devices of other users (NC-SA-2020-019 boo#1171572).
last seen2020-05-31
modified2020-05-26
plugin id136872
published2020-05-26
reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/136872
titleopenSUSE Security Update : nextcloud (openSUSE-2020-670)

References