CVE-2016-9468
28.03.2017, 02:59
Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a potential misrepresentation of information.
| Vendor | Product | Version |
|---|---|---|
| nextcloud | nextcloud_server | 𝑥 < 9.0.54 |
| nextcloud | nextcloud_server | 10.0.0 ≤ 𝑥 ≤ 10.0.1 |
| owncloud | owncloud | 9.0.0 ≤ 𝑥 < 9.0.6 |
| owncloud | owncloud | 9.1.0 ≤ 𝑥 < 9.1.2 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Common Weakness Enumeration
- CWE-451 - User Interface (UI) Misrepresentation of Critical InformationThe user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
- CWE-284 - Improper Access ControlThe software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
References