CVE-2017-0888
05.04.2017, 20:59
Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Content-Spoofing vulnerability in the "files" app. The top navigation bar displayed in the files list contained partially user-controllable input leading to a potential misrepresentation of information.
| Vendor | Product | Version |
|---|---|---|
| nextcloud | nextcloud | 𝑥 ≤ 9.0.54 |
| nextcloud | nextcloud_server | 10.0.2 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-451 - User Interface (UI) Misrepresentation of Critical InformationThe user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
- CWE-20 - Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.