CVE-2016-9460CWE-451

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app

published March 28, 2017

CVSS
—
EPSS
2%
Percentile
76.6
In the wild
Unconfirmed
What it is

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01681 · 76.6th percentile
Weakness
CWE-451 · User Interface (UI) Misrepresentation of Critical Information
Published
2017-03-28T02:46Z
EPSS history
Timeline
  • 28 MAR 02:46Z
    Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app
    cvelistv5