« Volver al listado

CVE-2020-8154

Estado: ModificadaAlta (7.7)—

An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Nextcloud — Nextcloud Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-8154",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "support@hackerone.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Nextcloud Server",
          "versions": [
            {
              "status": "affected",
              "version": "18.0.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-05-12T13:15:13.063",
  "references": [
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00037.html",
      "source": "support@hackerone.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00038.html",
      "source": "support@hackerone.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00040.html",
      "source": "support@hackerone.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00019.html",
      "source": "support@hackerone.com"
    },
    {
      "url": "https://hackerone.com/reports/819807",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KC6HLX5SG4PZO6Y54D2LFJ4ATG76BKOP/",
      "source": "support@hackerone.com"
    },
    {
      "url": "https://nextcloud.com/security/advisory/?id=NC-SA-2020-018",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00037.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00038.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00040.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00019.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://hackerone.com/reports/819807",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KC6HLX5SG4PZO6Y54D2LFJ4ATG76BKOP/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://nextcloud.com/security/advisory/?id=NC-SA-2020-018",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "support@hackerone.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de referencia directa a objeto No Segura en Nextcloud Server versión 18.0.2, permitió a un atacante limpiar de manera remota dispositivos de otros usuarios cuando se envía una petición maliciosa directamente al endpoint."
    }
  ],
  "lastModified": "2026-06-17T03:25:57.217",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B292CEB0-6280-4BB4-9DA2-C3E790485C3F",
              "versionEndExcluding": "17.0.5"
            },
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "644B3B6B-E788-4EDB-8C37-AFF3BF25973C",
              "versionEndExcluding": "18.0.3",
              "versionStartIncluding": "18.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "support@hackerone.com"
}