Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the public key to decrypt them later on.
References
Link | Resource |
---|---|
http://seclists.org/fulldisclosure/2020/Dec/54 | Exploit Mailing List Third Party Advisory |
https://hackerone.com/reports/743505 | Exploit Issue Tracking Third Party Advisory |
https://nextcloud.com/security/advisory/?id=NC-SA-2020-040 | Broken Link Vendor Advisory |
Configurations
History
27 Sep 2022, 15:46
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:* | |
First Time |
Nextcloud nextcloud Server
|
|
References | (FULLDISC) http://seclists.org/fulldisclosure/2020/Dec/54 - Exploit, Mailing List, Third Party Advisory | |
References | (MISC) https://nextcloud.com/security/advisory/?id=NC-SA-2020-040 - Broken Link, Vendor Advisory |
24 May 2022, 17:06
Type | Values Removed | Values Added |
---|---|---|
References | (FULLDISC) http://seclists.org/fulldisclosure/2020/Dec/54 - Mailing List, Third Party Advisory |
Information
Published : 2020-11-16 01:15
Updated : 2023-12-10 13:41
NVD link : CVE-2020-8152
Mitre link : CVE-2020-8152
CVE.ORG link : CVE-2020-8152
JSON object : View
Products Affected
nextcloud
- nextcloud_server
CWE
CWE-522
Insufficiently Protected Credentials