CVE-2016-9467: nextcloud nextcloud_server
Vulnerability summary
CVE-2016-9467 is a medium (CVSS 5.3) vulnerability in nextcloud nextcloud_server. EPSS estimates a 2.97% chance of exploitation in the next 30 days, higher than 87% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 28-03-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.97%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
0.00 pp
From 2.97% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-451User Interface (UI) Misrepresentation of Critical InformationThe user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Affected systems
Nextcloud1 product
- nextcloud_server< 9.0.54 | ≥ 10.0.0, < 10.0.1
Owncloud1 product
- owncloud≥ 9.0.0, < 9.0.6 | ≥ 9.1.0, < 9.1.2
2 vendors · 2 products
References
11 links- github.com/nextcloud/server/commit/5dd211cc8845fd4533966bf8d7a7f2a6359ea013X Refsource MISCIssue TrackingPatchThird Party Advisory
- github.com/nextcloud/server/commit/ed0f0db5fa0aff04594cb0f973ae4c22b17a175aX Refsource MISCIssue TrackingPatchThird Party Advisory
- github.com/nextcloud/server/commit/df50e967dbd27b13875625b7dd3189294619b071X Refsource MISCIssue TrackingPatchThird Party Advisory
- github.com/owncloud/core/commit/768221fcf3c526c65d85f62b0efa2da5ea00bf2dX Refsource MISCIssue TrackingPatchThird Party Advisory
- github.com/owncloud/core/commit/e7acbce27fa0ef1c6fe216ca67c72d86484919a4X Refsource MISCIssue TrackingPatchThird Party Advisory
- github.com/nextcloud/server/commit/c3ae21fef2880c9fe44e8fdbe1262ac7f9716f14X Refsource MISCIssue TrackingPatchThird Party Advisory
- github.com/nextcloud/server/commit/1352365e8bf5ea49da3dc82b1ccf7ddb659ae960X Refsource MISCIssue TrackingPatchThird Party Advisory
- github.com/nextcloud/server/commit/778ae8abd54c378fc4781394bbedc7a2ee3095e1X Refsource MISCIssue TrackingPatchThird Party Advisory