CVE-2016-9460: nextcloud

Vulnerability summary

CVE-2016-9460 is a medium (CVSS 5.3) vulnerability in nextcloud. EPSS estimates a 1.68% chance of exploitation in the next 30 days, higher than 76.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 28-03-2017
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.

• CWE-451User Interface (UI) Misrepresentation of Critical InformationThe user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.