NVD Vulnerability Detail

CVE-2016-9468

Summary	Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a potential misrepresentation of information.
Publication Date	March 28, 2017, 11:59 a.m.
Registration Date	Jan. 26, 2021, 2:20 p.m.
Last Update	Nov. 21, 2024, 12:01 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:owncloud:owncloud::::::::	9.1.0			9.1.2
cpe:2.3:a:nextcloud:nextcloud_server::::::::				9.0.54
cpe:2.3:a:owncloud:owncloud::::::::	9.0.0			9.0.6
cpe:2.3:a:nextcloud:nextcloud_server::::::::	10.0.0	10.0.1

Related information, measures and tools

No	URL	タグ
1	https://github.com/nextcloud/server/commit/7350e13113c8ed484727a5c25331ec11d4d59f5f	Issue Tracking Patch Third Party Advisory
2	https://github.com/nextcloud/server/commit/7350e13113c8ed484727a5c25331ec11d4d59f5f	Issue Tracking Patch Third Party Advisory
3	https://github.com/nextcloud/server/commit/a4cfb3ddc1f4cdb585e05c0e9b2f8e52a0e2ee3e	Issue Tracking Patch Third Party Advisory
4	https://github.com/nextcloud/server/commit/a4cfb3ddc1f4cdb585e05c0e9b2f8e52a0e2ee3e	Issue Tracking Patch Third Party Advisory
5	https://github.com/owncloud/core/commit/96b8afe48570bc70088ccd8f897e9d71997d336e	Issue Tracking Patch Third Party Advisory
6	https://github.com/owncloud/core/commit/96b8afe48570bc70088ccd8f897e9d71997d336e	Issue Tracking Patch Third Party Advisory
7	https://github.com/owncloud/core/commit/bcc6c39ad8c22a00323a114e9c1a0a834983fb35	Issue Tracking Patch Third Party Advisory
8	https://github.com/owncloud/core/commit/bcc6c39ad8c22a00323a114e9c1a0a834983fb35	Issue Tracking Patch Third Party Advisory
9	https://hackerone.com/reports/149798	Exploit Third Party Advisory
10	https://hackerone.com/reports/149798	Exploit Third Party Advisory
11	https://nextcloud.com/security/advisory/?id=nc-sa-2016-011	Patch Vendor Advisory
12	https://nextcloud.com/security/advisory/?id=nc-sa-2016-011	Patch Vendor Advisory
13	https://owncloud.org/security/advisory/?id=oc-sa-2016-021	Patch Vendor Advisory
14	https://owncloud.org/security/advisory/?id=oc-sa-2016-021	Patch Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-284	不適切なアクセス制御	https://cwe.mitre.org/data/definitions/284.html

JVN Vulnerability Information

Nextcloud サーバおよび ownCloud サーバにおけるアクセス制御に関する脆弱性

Title	Nextcloud サーバおよび ownCloud サーバにおけるアクセス制御に関する脆弱性
Summary	Nextcloud サーバおよび ownCloud サーバには、アクセス制御に関する脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 10, 2016, midnight
Registration Date	April 26, 2017, 6:48 p.m.
Last Update	April 26, 2017, 6:48 p.m.

Affected System

ownCloud

ownCloud 9.0.6 未満

ownCloud 9.1.2 未満

Nextcloud

Nextcloud 10.0.1 未満

Nextcloud 9.0.54 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-9468	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9468
National Vulnerability Database (NVD)
2	CVE-2016-9468	https://nvd.nist.gov/vuln/detail/CVE-2016-9468

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-284	https://cwe.mitre.org/data/definitions/284.html

ベンダー情報

No	Name	URL
Security Advisory
1	NC-SA-2016-011	https://nextcloud.com/security/advisory/?id=nc-sa-2016-011
2	oC-SA-2016-021	https://owncloud.org/security/advisory/?id=oc-sa-2016-021

Change Log

No	Changed Details	Date of change
0	[2017年04月26日] 掲載	Feb. 17, 2018, 10:37 a.m.