Overview
- Description
- Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and 27.0.1, unauthenticated users could send a DAV request which reveals whether a calendar or an address book with the given identifier exists for the victim. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 5.3
- Impact score
- 1.4
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Severity
- MEDIUM
Weaknesses
- security-advisories@github.com
- CWE-284
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*",
"vulnerable": true,
"matchCriteriaId": "623D58E0-57A0-42B3-8ED6-DF3B988633AB",
"versionEndExcluding": "25.0.9",
"versionStartIncluding": "25.0.0"
},
{
"criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D60D3184-C289-49E8-9FBE-EDA8B927131A",
"versionEndExcluding": "25.0.9",
"versionStartIncluding": "25.0.0"
},
{
"criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CA187E45-EB4B-468A-9291-FD66B360B2D6",
"versionEndExcluding": "26.0.4",
"versionStartIncluding": "26.0.0"
},
{
"criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2D0FA653-A595-4EC8-9F77-0AD1A4699B07",
"versionEndExcluding": "26.0.4",
"versionStartIncluding": "26.0.0"
},
{
"criteria": "cpe:2.3:a:nextcloud:nextcloud_server:27.0.0:*:*:*:-:*:*:*",
"vulnerable": true,
"matchCriteriaId": "13650329-BCD1-4FDB-9446-5133C0EDC905"
},
{
"criteria": "cpe:2.3:a:nextcloud:nextcloud_server:27.0.0:*:*:*:enterprise:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DB1974B0-31C5-4E22-9E8C-BD40C6B54D0C"
}
],
"operator": "OR"
}
]
}
]