| Vulnerability Name: | CVE-2016-9461 (CCN-123938) | ||||||||||||
| Assigned: | 2016-10-10 | ||||||||||||
| Published: | 2016-10-10 | ||||||||||||
| Updated: | 2019-10-09 | ||||||||||||
| Summary: | Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was not properly checking the permission on a WebDAV COPY action. This allowed an authenticated attacker with access to a read-only share to put new files in there. It was not possible to modify existing files. | ||||||||||||
| CVSS v3 Severity: | 4.3 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) 3.8 Low (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)
2.7 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)
| ||||||||||||
| CVSS v2 Severity: | 4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
| ||||||||||||
| Vulnerability Type: | CWE-284 | ||||||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2016-9461 Source: BID Type: Third Party Advisory, VDB Entry 97276 Source: CCN Type: BID-97276 ownCloud and Nextcloud CVE-2016-9461 Unauthorized Access Vulnerability Source: XF Type: UNKNOWN nextcloud-owncloud-cve20169461-sec-bypass(123938) Source: MISC Type: Issue Tracking, Patch, Third Party Advisory https://github.com/nextcloud/server/commit/3491400261c1454a9a30d3ec96969573330120cc Source: MISC Type: Issue Tracking, Patch, Third Party Advisory https://github.com/owncloud/core/commit/0622e635d97cb17c5e1363e370bb8268cc3d2547 Source: MISC Type: Issue Tracking, Patch, Third Party Advisory https://github.com/owncloud/core/commit/121a3304a0c37ccda0e1b63ddc528cba9121a36e Source: MISC Type: Issue Tracking, Patch, Third Party Advisory https://github.com/owncloud/core/commit/acbbadb71ceee7f01da347f7dcd519beda78cc47 Source: MISC Type: Issue Tracking, Patch, Third Party Advisory https://github.com/owncloud/core/commit/c0a4b7b3f38ad2eaf506484b3b92ec678cb021c9 Source: MISC Type: Exploit, Third Party Advisory https://hackerone.com/reports/145950 Source: CCN Type: nextCloud Security Advisory NC-SA-2016-004 Edit permission check not enforced on WebDAV COPY action Source: MISC Type: Patch, Vendor Advisory https://nextcloud.com/security/advisory/?id=nc-sa-2016-004 Source: CCN Type: ownCloud Security Advisory oC-SA-2016-014 Edit permission check not enforced on WebDAV COPY action Source: MISC Type: Patch, Vendor Advisory https://owncloud.org/security/advisory/?id=oc-sa-2016-014 Source: CCN Type: WhiteSource Vulnerability Database CVE-2016-9461 | ||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||
| Oval Definitions | |||||||||||||
| |||||||||||||
| BACK | |||||||||||||