Lucene search

HackeroneCVE-2020-8223

HistoryOct 05, 2020 - 2:15 p.m.

CVE-2020-8223

2020-10-0514:15:13

CWE-269

hackerone

web.nvd.nist.gov

nextcloud

server

19.0.0

logic error

privilege escalation

nvd

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

AI Score

6.6

Confidence

High

EPSS

0.002

Percentile

56.7%

JSON

A logic error in Nextcloud Server 19.0.0 caused a privilege escalation allowing malicious users to reshare with higher permissions than they got assigned themselves.

Affected configurations

Nvd

Vulners

Node

nextcloudnextcloud_serverMatch19.0.0-

Node

fedoraprojectfedoraMatch32

fedoraprojectfedoraMatch33

VendorProductVersionCPE
nextcloudnextcloud_server19.0.0cpe:2.3:a:nextcloud:nextcloud_server:19.0.0:-:*:*:*:*:*:*
fedoraprojectfedora32cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
fedoraprojectfedora33cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nextcloud	nextcloud_server	19.0.0	cpe:2.3:a:nextcloud:nextcloud_server:19.0.0:-::::::
fedoraproject	fedora	32	cpe:2.3:o:fedoraproject:fedora:32:::::::*
fedoraproject	fedora	33	cpe:2.3:o:fedoraproject:fedora:33:::::::*

CNA Affected

[
  {
    "product": "Nextcloud Server",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed in 19.0.1"
      }
    ]
  }
]