CVE-2020-8154: High severity nextcloud server vulnerability
Published May 12, 2020
·Updated
An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint.
Affected Software
2 affected components
Nextcloud Server<17.0.5
Nextcloud Server>=18.0.0<18.0.3
Event History
May 12, 2020
CVE Published
via MITRE·01:01 PM
Data Sourced
via MITRE·01:01 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2020-8154?
CVE-2020-8154 is classified as a high severity vulnerability due to its potential to allow unauthorized remote wipe of user devices.
2
How do I fix CVE-2020-8154?
To fix CVE-2020-8154, upgrade Nextcloud Server to version 18.0.3 or later, or 17.0.6 or a later version.
3
What versions of Nextcloud Server are affected by CVE-2020-8154?
CVE-2020-8154 affects Nextcloud Server versions prior to 18.0.3 and versions up to but not including 17.0.5.
4
What type of vulnerability is CVE-2020-8154?
CVE-2020-8154 is an Insecure Direct Object Reference (IDOR) vulnerability.
5
What are the potential impacts of CVE-2020-8154?
The potential impacts of CVE-2020-8154 include the ability for attackers to remotely wipe the devices of other users.