Vulnerability · Published Oct 5, 2020 · Assigned by hackerone
CVE-2020-8235
Medium 4.3
In plain English
A medium-severity authorization bypass via user-controlled key in Nextcloud Deck app. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Severity (CVSS NVD)4.3Medium
Exploit odds (30 days)0.8%top 43.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Missing access control in Nextcloud Deck 1.0.4 caused an insecure direct object reference allowing an attacker to view all attachments.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Nextcloud Deck app | Fixed in 1.0.5 |
Weakness: CWE-639
References
- https://hackerone.com/reports/916704 x_refsource_MISC
- https://nextcloud.com/security/advisory/?id=NC-SA-2020-036 x_refsource_MISC