CVE-2017-0884 in Nextcloud Server
Summary
Nextcloud Server before 9.0.55 and 10.0.2 suffers from a creation of folders in read-only folders despite lacking permissions issue. Due to a logical error in the file caching layer an authenticated adversary is able to create empty folders inside a shared folder. Note that this only affects folders and files that the adversary has at least read-only permissions for.
Reservation
11/30/2016
Disclosure
04/05/2017
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 99314 | Nextcloud Server Shared Folder permission | 275 | Not defined | Official fix | CVE-2017-0884 |