Vulnerability · Published May 12, 2020 · Assigned by hackerone
CVE-2020-8154
High 7.7
In plain English
A high-severity authorization bypass via user-controlled key in Nextcloud Server. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 78% of all known vulnerabilities).
Severity (CVSS NVD)7.7High
Exploit odds (30 days)1.8%top 21.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Nextcloud Server | 18.0.3 |
Weakness: CWE-639
References
- https://hackerone.com/reports/819807 x_refsource_MISC
- https://nextcloud.com/security/advisory/?id=NC-SA-2020-018 x_refsource_MISC
- openSUSE-SU-2020:0667 vendor-advisory, x_refsource_SUSE
- openSUSE-SU-2020:0668 vendor-advisory, x_refsource_SUSE
- openSUSE-SU-2020:0670 vendor-advisory, x_refsource_SUSE
- openSUSE-SU-2020:1652 vendor-advisory, x_refsource_SUSE
- FEDORA-2020-c9863904de vendor-advisory, x_refsource_FEDORA