CVE-2016-9464 — Improper Authorization in Server

CWE-285 — Improper Authorization3 documents3 sources
Severity
4.3MEDIUMNVD
EPSS
0.3%
top 47.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Nextcloud Server
Timeline
PublishedMar 28
Latest updateMay 13

Description

Nextcloud Server before 9.0.54 and 10.0.0 suffers from an improper authorization check on removing shares. The Sharing Backend as implemented in Nextcloud does differentiate between shares to users and groups. In case of a received group share, users should be able to unshare the file to themselves but not to the whole group. The previous API implementation simply unshared the file to all users in the group.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages1 packages

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-r69w-pvjm-xg3v: Nextcloud Server before 9↗2022-05-13
▶
CVEList
CVE-2016-9464: Nextcloud Server before 9↗2017-03-28
▶
CVE-2016-9464 — Improper Authorization in Server | cvebase