CVE-2017-0894 — Improper Authorization in Server

CWE-285 — Improper AuthorizationCWE-863 — Incorrect AuthorizationCWE-200 — Sensitive Information Exposure9 documents5 sources
Severity
4.3MEDIUMNVD
EPSS
0.8%
top 26.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Nextcloud Server
Timeline
PublishedMay 8
Latest updateMay 13

Description

Nextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public calendars due to a logical error. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5nextcloud/nextcloud_serverbefore 11.0.3

Patches

Patch: nextcloud.com ↗Patch: nextcloud.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-2c99-9fv7-72hj: Nextcloud Server before 11↗2022-05-13
▶
CVEList
CVE-2017-0894: Nextcloud Server before 11↗2017-05-08
▶

💬Community

6
HackerOne
Share tokens for public calendars disclosed (NC-SA-2017-011)↗2017-06-06
▶
Bugzilla
CVE-2017-0890 CVE-2017-0891 CVE-2017-0892 CVE-2017-0893 CVE-2017-0894 CVE-2017-0895 owncloud: nextcloud: Multiple security issues [epel-7]↗2017-05-16
▶
Bugzilla
CVE-2017-0890 CVE-2017-0891 CVE-2017-0892 CVE-2017-0893 CVE-2017-0894 CVE-2017-0895 owncloud: nextcloud: Multiple security issues [fedora-all]↗2017-05-16
▶
Bugzilla
CVE-2017-0890 CVE-2017-0891 CVE-2017-0892 CVE-2017-0893 CVE-2017-0894 CVE-2017-0895 nextcloud: Multiple security issues [fedora-all]↗2017-05-09
▶
Bugzilla
CVE-2017-0890 CVE-2017-0891 CVE-2017-0892 CVE-2017-0893 CVE-2017-0894 CVE-2017-0895 nextcloud: Multiple security issues [epel-7]↗2017-05-09
▶