CVE-2016-9468
First published: Tue Mar 28 2017(Updated: )
Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a potential misrepresentation of information.
Credit: support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nextcloud Server | <9.0.54 | |
| Nextcloud Server | >=10.0.0<=10.0.1 | |
| ownCloud | >=9.0.0<9.0.6 | |
| ownCloud | >=9.1.0<9.1.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/nextcloud/server/commit/7350e13113c8ed484727a5c25331ec11d4d59f5f
- https://github.com/nextcloud/server/commit/a4cfb3ddc1f4cdb585e05c0e9b2f8e52a0e2ee3e
- https://github.com/owncloud/core/commit/96b8afe48570bc70088ccd8f897e9d71997d336e
- https://github.com/owncloud/core/commit/bcc6c39ad8c22a00323a114e9c1a0a834983fb35
- https://hackerone.com/reports/149798
- https://nextcloud.com/security/advisory/?id=nc-sa-2016-011
- https://owncloud.org/security/advisory/?id=oc-sa-2016-021
Frequently Asked Questions
What is the severity of CVE-2016-9468?
CVE-2016-9468 is considered a moderate severity vulnerability due to its potential for content spoofing.
How do I fix CVE-2016-9468?
To fix CVE-2016-9468, update Nextcloud Server to version 9.0.54 or higher, or 10.0.1 or higher, and update ownCloud Server to versions 9.0.6 or higher, or 9.1.2 or higher.
What systems are affected by CVE-2016-9468?
CVE-2016-9468 affects Nextcloud Server versions before 9.0.54 and 10.0.1, as well as ownCloud Server versions before 9.0.6 and 9.1.2.
What does CVE-2016-9468 exploit?
CVE-2016-9468 exploits content spoofing vulnerabilities in the DAV app, leading to potential misrepresentation of information.
Is there a patch available for CVE-2016-9468?
Yes, patches are available in the updated versions of Nextcloud and ownCloud to address CVE-2016-9468.
- agent/weakness
- agent/type
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/references
- agent/severity
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/nextcloud
- canonical/nextcloud server
- version/nextcloud server/10.0.0
- version/nextcloud server/10.0.1
- vendor/owncloud
- canonical/owncloud
- version/owncloud/9.0.0
- version/owncloud/9.1.0