Description

Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.

Remediation

References

CVE-2016-9467

Related Vulnerabilities

WordPress Plugin eShop Multiple Cross-Site Scripting Vulnerabilities (6.2.8)

MySQL CVE-2019-2780 Vulnerability (CVE-2019-2780)

WordPress Plugin User Registration-Custom Registration Form, Login Form, and User Profile Privilege Escalation (3.1.5)

OpenSSL Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Vulnerability (CVE-2014-3509)

WordPress Plugin Google Analytics Dashboard Plugin for WordPress by MonsterInsights Multiple Cross-Site Scripting Vulnerabilities (5.3.3)

Severity

Medium

Classification

CVE-2016-9467 CWE-284 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities