CVE-2016-9461

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions

published March 28, 2017

CVSS
—
EPSS
2%
Percentile
80.6
In the wild
Unconfirmed
What it is

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was not properly checking the permission on a WebDAV COPY action. This allowed an authenticated attacker with access to a read-only share to put new files in there. It was not possible to modify existing files.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02000 · 80.6th percentile
Published
2017-03-28T02:46Z
EPSS history
Timeline
  • 28 MAR 02:46Z
    Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions
    cvelistv5