CVE-2017-0888

MEDIUM

Nextcloud Server <9.0.55, 10.0.2 - Info Disclosure

Title source: llm

Description

Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Content-Spoofing vulnerability in the "files" app. The top navigation bar displayed in the files list contained partially user-controllable input leading to a potential misrepresentation of information.

References (3)

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/97491

[Third Party Advisory] https://hackerone.com/reports/179073

[Patch, Vendor Advisory] https://nextcloud.com/security/advisory/?id=nc-sa-2017-006

Scores

CVSS v3 4.3

EPSS 0.0054

EPSS Percentile 67.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Classification

CWE

CWE-451 CWE-20

Status published

Affected Products (3)

nextcloud/nextcloud < 9.0.54

nextcloud/nextcloud_server

Nextcloud/Nextcloud Server < All versions before 9.0.55 and 10.0.2

Timeline

Published Apr 05, 2017

Tracked Since Feb 18, 2026