Not rated
CVE-2020-8227 Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud…
Description
Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud Server to store files outside of the dedicated sync directory.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Desktop Client | 2.6.5 | No fix stated |
References
- hackerone.com hackerone.com
- nextcloud.com nextcloud.com
- GLSA-202009-09 security.gentoo.org
Timeline
- Published
- Last modified
Other CVEs of Desktop Client
The 7 CVEs of Desktop Client →
CVE-2020-8225
A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used…
Not rated
CVE-2020-8189
A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links)…
Not rated
CVE-2020-8230
A memory corruption vulnerability exists in NextCloud Desktop Client v2.6.4 where missing ASLR and DEP protections in…
Not rated
CVE-2020-8224
A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL…
Not rated