CVE-2017-0883 in Server
Summary
Nextcloud Server before 9.0.55 and 10.0.2 suffers from a permission increase on re-sharing via OCS API issue. A permission related issue within the OCS sharing API allowed an authenticated adversary to reshare shared files with an increasing permission set. This may allow an attacker to edit files in a share despite having only a 'read' permission set. Note that this only affects folders and files that the adversary has at least read-only permissions for.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Reservation
11/30/2016
Disclosure
04/05/2017
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 99313 | Nextcloud Server OCS API permission | 275 | Not defined | Official fix | CVE-2017-0883 |