CVE-2016-9463 — Incorrect Implementation of Authentication Algorithm in Server

CWE-303 — Incorrect Implementation of Authentication AlgorithmCWE-287 — Improper Authentication3 documents3 sources
Severity
8.1HIGHNVD
EPSS
3.9%
top 11.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Nextcloud ServerOwncloud
Timeline
PublishedMar 28
Latest updateMay 13

Description

Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authentication Bypass. Nextcloud/ownCloud include an optional and not by default enabled SMB authentication component that allows authenticating users against an SMB server. This backend is implemented in a way that tries to connect to a SMB server and if that succeeded consider the user logged-in. The backend did not properly take into account SMB servers that have any kind of anonymo…

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages2 packages

▶NVDnextcloud/nextcloud_server10.0.0 — 10.0.1+1
▶NVDowncloud/owncloud8.2.0 — 8.2.9+2

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-4r4x-7f2r-2f4c: Nextcloud Server before 9↗2022-05-13
▶
CVEList
CVE-2016-9463: Nextcloud Server before 9↗2017-03-28
▶
CVE-2016-9463 — Nextcloud Server vulnerability | cvebase