CVE-2016-9467: Medium severity nextcloud server vulnerability
Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9467?
CVE-2016-9467 is classified as a medium severity vulnerability due to its potential for content spoofing.
How do I fix CVE-2016-9467?
To fix CVE-2016-9467, upgrade Nextcloud Server to versions 9.0.54 or 10.0.1 and ownCloud Server to versions 9.0.6 or 9.1.2.
What are the affected versions in CVE-2016-9467?
CVE-2016-9467 affects Nextcloud Server versions prior to 9.0.54 and 10.0.0 to 10.0.1, and ownCloud Server versions prior to 9.0.6 and 9.1.0 to 9.1.2.
What is content spoofing in the context of CVE-2016-9467?
Content spoofing in CVE-2016-9467 allows an attacker to create deceptive links that display false content in the files app.
Can CVE-2016-9467 lead to phishing attacks?
Yes, CVE-2016-9467 could potentially lead to phishing attacks by allowing attackers to mislead users with crafted links.