CVE-2018-3762

Medium

Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still…

hackerone·CWE-284·Published 2018-07-05

CVSS

4.3

EPSS

0.01

KEV

Exploits

cve.orgen

195 chars

Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still request previews for files it should not have access to.

NVDen

195 chars

Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still request previews for files it should not have access to.

Nextcloud Server en versiones anteriores a la 12.0.8 y la 13.0.3 sufre de comprobaciones incorrectas de permisos abandonados para comparticiones entrantes, lo que permite que un usuario pueda seguir solicitando previsualizaciones de archivos a los que no debería tener acceso.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	4.0	8.0	2.9	AV:N/AC:L/Au:S/C:P/I:N/A:N
3.1	Primary	NVD	4.3	2.8	1.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N