CVE-2020-8296: fedoraproject fedora
CVSS: 6.7v3.1MediumModified
Published 03-03-2021Last modified 04-08-2024
Vulnerability summary
CVE-2020-8296 is a medium (CVSS 6.7) vulnerability in fedoraproject fedora. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.4% of scored vulnerabilities. 2 public exploits are recorded.
CVSS score
6.7/10
010
Medium · v3.1 (NVD)EPSS score
0.51%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2github, reference
Timeline
- 03-03-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured.
CVSS metrics
2 scores · 1 source · 2 versionsMedium 6.7Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HSourcesSingle source
Medium 4.6Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
0.51%
Chance of exploitation in the next 30 days
Percentile
42%
Versus all other CVEs
30-day change
0.00 pp
From 0.51% on 19-09-2026
19-09-202619-10-2026
EPSS score0.51%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundServer
Maturity: poc
Exploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-257Storing Passwords in a Recoverable FormatThe storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.
- CWE-521Weak Password RequirementsThe product does not require that users should have strong passwords.
Affected systems
Fedoraproject1 product
- fedoraEOL34
Nextcloud1 product
- nextcloud_server< 20.0.0
2 vendors · 2 products