CVE-2016-9468: nextcloud nextcloud_server
CVSS: 5.3v3.0MediumModified
Published 28-03-2017Last modified 06-08-2024
Vulnerability summary
CVE-2016-9468 is a medium (CVSS 5.3) vulnerability in nextcloud nextcloud_server. EPSS estimates a 2.08% chance of exploitation in the next 30 days, higher than 81.1% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
5.3/10
010
Medium · v3.0 (NVD)EPSS score
2.08%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 28-03-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a potential misrepresentation of information.
CVSS metrics
2 scores · 1 source · 2 versionsMedium 5.3Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NSourcesSingle source
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
2.08%
Chance of exploitation in the next 30 days
Percentile
81%
Versus all other CVEs
30-day change
0.00 pp
From 2.08% on 18-09-2026
18-09-202618-10-2026
EPSS score2.08%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-451User Interface (UI) Misrepresentation of Critical InformationThe user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Affected systems
Nextcloud1 product
- nextcloud_server< 9.0.54 | ≥ 10.0.0, ≤ 10.0.1
Owncloud1 product
- owncloud≥ 9.0.0, < 9.0.6 | ≥ 9.1.0, < 9.1.2
2 vendors · 2 products
References
7 links- github.com/nextcloud/server/commit/a4cfb3ddc1f4cdb585e05c0e9b2f8e52a0e2ee3eX Refsource MISCIssue TrackingPatchThird Party Advisory
- github.com/nextcloud/server/commit/7350e13113c8ed484727a5c25331ec11d4d59f5fX Refsource MISCIssue TrackingPatchThird Party Advisory
- github.com/owncloud/core/commit/96b8afe48570bc70088ccd8f897e9d71997d336eX Refsource MISCIssue TrackingPatchThird Party Advisory
- github.com/owncloud/core/commit/bcc6c39ad8c22a00323a114e9c1a0a834983fb35X Refsource MISCIssue TrackingPatchThird Party Advisory