CVE-2017-0895 — Improper Authorization in Server

CWE-285 — Improper AuthorizationCWE-200 — Sensitive Information Exposure9 documents5 sources
Severity
3.5LOWNVD
EPSS
0.1%
top 68.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Nextcloud Server
Timeline
PublishedMay 8
Latest updateMay 13

Description

Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that no actual content of the calendar and addressbook has been disclosed.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:NExploitability: 2.1 | Impact: 1.4

Affected Packages2 packages

▶NVDnextcloud/nextcloud_server10.0.0 — 10.0.4+1
▶CVEListV5nextcloud/nextcloud_serverbefore 10.0.4 and 11.0.2

🔴Vulnerability Details

2
GHSA
GHSA-mc2j-762j-c5hj: Nextcloud Server before 10↗2022-05-13
▶
CVEList
CVE-2017-0895: Nextcloud Server before 10↗2017-05-08
▶

💬Community

6
Bugzilla
CVE-2017-0890 CVE-2017-0891 CVE-2017-0892 CVE-2017-0893 CVE-2017-0894 CVE-2017-0895 owncloud: nextcloud: Multiple security issues [epel-7]↗2017-05-16
▶
Bugzilla
CVE-2017-0890 CVE-2017-0891 CVE-2017-0892 CVE-2017-0893 CVE-2017-0894 CVE-2017-0895 owncloud: nextcloud: Multiple security issues [fedora-all]↗2017-05-16
▶
Bugzilla
CVE-2017-0890 CVE-2017-0891 CVE-2017-0892 CVE-2017-0893 CVE-2017-0894 CVE-2017-0895 nextcloud: Multiple security issues [fedora-all]↗2017-05-09
▶
Bugzilla
CVE-2017-0890 CVE-2017-0891 CVE-2017-0892 CVE-2017-0893 CVE-2017-0894 CVE-2017-0895 nextcloud: Multiple security issues [epel-7]↗2017-05-09
▶
Bugzilla
CVE-2017-0890 CVE-2017-0891 CVE-2017-0892 CVE-2017-0893 CVE-2017-0894 CVE-2017-0895 nextcloud: Multiple security issues↗2017-05-09
▶
CVE-2017-0895 — Improper Authorization in Server | cvebase