CVE-2018-3776
12.08.2018, 22:29
Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker's actions not being logged in the audit log.Enginsight
| Vendor | Product | Version |
|---|---|---|
| nextcloud | nextcloud_server | 11.0.0 ≤ 𝑥 < 11.0.5 |
| nextcloud | nextcloud_server | 12.0.0 ≤ 𝑥 < 12.0.3 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-20 - Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-532 - Insertion of Sensitive Information into Log FileInformation written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.