« Volver al listado

CVE-2020-8118

Estado: ModificadaMedia (5)—

An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Nextcloud — Nextcloud ServerNovell — Suse Linux Enterprise ServerOpensuse — Backports SLE

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-8118",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "support@hackerone.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Nextcloud Server",
          "versions": [
            {
              "status": "affected",
              "version": "16.0.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-02-04T20:15:13.730",
  "references": [
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00019.html",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00022.html",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://hackerone.com/reports/427835",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://nextcloud.com/security/advisory/?id=NC-SA-2019-014",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00019.html",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00022.html",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://hackerone.com/reports/427835",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://nextcloud.com/security/advisory/?id=NC-SA-2019-014",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "support@hackerone.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar application."
    },
    {
      "lang": "es",
      "value": "Un ataque de tipo server-side request forgery autenticado en Nextcloud versión 16.0.1, permitió detectar servicios locales y remotos al agregar una nueva suscripción en la aplicación calendar."
    }
  ],
  "lastModified": "2026-06-17T03:25:53.553",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4918793-0B98-42FC-B185-8B8B3E58C0C7",
              "versionEndExcluding": "15.0.9"
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "930E2DE7-4D34-4634-8FC4-CDEB45A9B8EF",
              "versionEndExcluding": "16.0.2",
              "versionStartIncluding": "16.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40513095-7E6E-46B3-B604-C926F1BA3568"
            },
            {
              "criteria": "cpe:2.3:o:novell:suse_linux_enterprise_server:12.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B097F99-D0D7-4B32-9E1A-BE5E653CFA7C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "support@hackerone.com"
}