Vulnerability · Published Jan 26, 2021 · Assigned by hackerone
CVE-2020-8293
Medium 6.5
In plain English
A medium-severity uncontrolled resource consumption in Nextcloud Server. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).
Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)1.6%top 24.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to store unlimited data in workflow rules causing load and potential DDoS on later interactions and usage with those rules.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Nextcloud Server | Fixed in 20.0.2, 19.0.5, 18.0.11 |
Weakness: CWE-400
References
- https://hackerone.com/reports/1018146 x_refsource_MISC
- https://nextcloud.com/security/advisory/?id=NC-SA-2021-001 x_refsource_MISC