CVE-2017-0884: nextcloud nextcloud_server Permission Issues
Vulnerability summary
CVE-2017-0884 is a medium (CVSS 4.3) Permission Issues vulnerability in nextcloud nextcloud_server. EPSS estimates a 0.67% chance of exploitation in the next 30 days, higher than 51.1% of scored vulnerabilities.
Timeline
- 05-04-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Nextcloud Server before 9.0.55 and 10.0.2 suffers from a creation of folders in read-only folders despite lacking permissions issue. Due to a logical error in the file caching layer an authenticated adversary is able to create empty folders inside a shared folder. Note that this only affects folders and files that the adversary has at least read-only permissions for.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.67%
Chance of exploitation in the next 30 days
Percentile
51%
Versus all other CVEs
30-day change
0.00 pp
From 0.67% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-275Permission IssuesWeaknesses in this category are related to improper assignment or handling of permissions.
- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Affected systems
Nextcloud1 product
- nextcloud_serverAll versions before 9.0.55 and 10.0.2 | < 9.0.55 | ≥ 10.0.0, < 10.0.2
1 vendor · 1 product
References
2 links- nextcloud.com/security/advisory/?id=nc-sa-2017-002X Refsource CONFIRMBroken LinkPatchVendor Advisory