Vulnerability · Published Mar 20, 2020 · Assigned by hackerone

CVE-2020-8139

Medium 6.5

In plain English

A medium-severity improper access control in Nextcloud Server. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).

Severity (CVSS NVD)6.5Medium

Exploit odds (30 days)1.5%top 25.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A missing access control check in Nextcloud Server < 18.0.1, < 17.0.4, and < 16.0.9 causes hide-download shares to be downloadable when appending /download to the URL.

Affected products (as reported)

Vendor	Product	Versions
n/a	Nextcloud Server	Fixed in 18.0.1, 17.0.4, and 16.0.9

Weakness: CWE-284

References

https://hackerone.com/reports/788257 x_refsource_MISC
https://nextcloud.com/security/advisory/?id=NC-SA-2020-015 x_refsource_CONFIRM
FEDORA-2020-c9863904de vendor-advisory, x_refsource_FEDORA