CVE-2020-8180

Опубликовано: 08 июн. 2020

Источник: nvd

CVSS3: 9.9

CVSS2: 6.5

EPSS Низкий

Описание

A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by an administrator.

Ссылки

https://hackerone.com/reports/851807
Exploit
Patch
Third Party Advisory
https://nextcloud.com/security/advisory/?id=NC-SA-2020-021
Vendor Advisory
https://hackerone.com/reports/851807
Exploit
Patch
Third Party Advisory
https://nextcloud.com/security/advisory/?id=NC-SA-2020-021
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*

Версия до 6.0.5 (исключая)

cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*

Версия от 7.0.0 (включая) до 7.0.3 (исключая)

cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*

Версия от 8.0.0 (включая) до 8.0.8 (исключая)

EPSS

Процентиль: 72%

0.00716

Низкий

9.9 Critical

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-94

Связанные уязвимости

GHSA-h68c-mg65-whp4

github

больше 3 лет назад

A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by an administrator.

EPSS

Процентиль: 72%

0.00716

Низкий

9.9 Critical

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-94