Vulnerability Description
Improper revalidation of permissions in Nextcloud Server prior to 14.0.0, 13.0.6 and 12.0.11 lead to not accepting access restrictions by acess tokens.
CVSS Score
8.1
HIGH
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nextcloud | Nextcloud Server | < 12.0.11 |
Related Weaknesses (CWE)
References
- https://hackerone.com/reports/388515Third Party Advisory
- https://nextcloud.com/security/advisory/?id=NC-SA-2018-010Vendor Advisory
- https://hackerone.com/reports/388515Third Party Advisory
- https://nextcloud.com/security/advisory/?id=NC-SA-2018-010Vendor Advisory
FAQ
What is CVE-2018-16466?
CVE-2018-16466 is a vulnerability with a CVSS score of 8.1 (HIGH). Improper revalidation of permissions in Nextcloud Server prior to 14.0.0, 13.0.6 and 12.0.11 lead to not accepting access restrictions by acess tokens.
How severe is CVE-2018-16466?
CVE-2018-16466 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-16466?
Check the references section above for vendor advisories and patch information. Affected products include: Nextcloud Nextcloud Server.