PT-2020-9745

CVE-2019-15621

Published

2020-02-04

Updated

2020-10-15

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Server version 16.0.1

Description The issue is related to improper permissions preservation, allowing sharees to reshare with write permissions when sharing the mount point of a share they received as a public link.

Recommendations For Nextcloud Server version 16.0.1, consider restricting the ability to reshare mounts of received shares to prevent unauthorized write access until a patch is available.

Exploitability

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-281: Improper Preservation of Permissions

Related identifiers

CVE-2019-15621

ALT-PU-2020-3060

OPENSUSE-SU-2020:0220-1

OPENSUSE-SU-2020_0220-1