CVE-2020-8138

Name of the Vulnerable Software and Affected Versions Nextcloud server versions prior to 17.0.1 Nextcloud server versions prior to 16.0.7 Nextcloud server versions prior to 15.0.14

Description A missing check for IPv4 nested inside IPv6 in the Nextcloud server allowed a Server-Side Request Forgery (SSRF) vulnerability when subscribing to a malicious calendar URL.

Recommendations For versions prior to 17.0.1, update to version 17.0.1 or later to resolve the issue. For versions prior to 16.0.7, update to version 16.0.7 or later to resolve the issue. For versions prior to 15.0.14, update to version 15.0.14 or later to resolve the issue.