CVE-2019-15623 — Exposure of Private Personal Information to an Unauthorized Actor in Server

CWE-359 — Exposure of Private Personal Information to an Unauthorized Actor6 documents4 sources

Severity

5.3MEDIUMNVD

EPSS

0.3%

top 44.67%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Nextcloud Server Opensuse Backports SLE

Timeline

PublishedFeb 4

Latest updateMay 24

Description

Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶NVDnextcloud/nextcloud_server15.0.0 — 15.0.9+2

▶CVEListV5nextcloud/nextcloud_server16.0.1

▶NVDopensuse/backports_sle15.0

🔴Vulnerability Details

GHSA

GHSA-7vfj-8rgw-2c3q: Exposure of Private Information in Nextcloud Server 16↗2022-05-24

▶

CVEList

CVE-2019-15623: Exposure of Private Information in Nextcloud Server 16↗2020-02-04

▶

💬Community

Bugzilla

CVE-2019-15613 CVE-2019-15612 CVE-2019-15616 CVE-2019-15617 CVE-2019-15618 CVE-2019-15621 CVE-2019-15623 CVE-2019-15624 CVE-2020-8118 CVE-2020-8119 CVE-2020-8121 CVE-2020-8122 nextcloud: Several CVEs ↗2020-02-21

▶

Bugzilla

CVE-2019-15612 CVE-2019-15613 CVE-2019-15616 CVE-2019-15617 CVE-2019-15618 CVE-2019-15621 CVE-2019-15623 CVE-2019-15624 CVE-2020-8118 CVE-2020-8119 CVE-2020-8121 CVE-2020-8122 nextcloud: Several CVEs ↗2020-02-21

▶

Bugzilla

▶