CVE-2020-8224

Опубликовано: 10 авг. 2020

Источник: nvd

CVSS3: 7.8

CVSS2: 4.6

EPSS Низкий

Описание

A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL config into a fixed directory.

Ссылки

https://hackerone.com/reports/622170
Exploit
Third Party Advisory
https://nextcloud.com/security/advisory/?id=NC-SA-2020-030
Broken Link
Vendor Advisory
https://security.gentoo.org/glsa/202009-09
Third Party Advisory
https://hackerone.com/reports/622170
Exploit
Third Party Advisory
https://nextcloud.com/security/advisory/?id=NC-SA-2020-030
Broken Link
Vendor Advisory
https://security.gentoo.org/glsa/202009-09
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:nextcloud:desktop:*:*:*:*:*:*:*:*

Версия до 2.6.5 (исключая)

EPSS

Процентиль: 52%

0.00662

Низкий

7.8 High

CVSS3

4.6 Medium

CVSS2

Дефекты

CWE-94

Связанные уязвимости

CVE-2020-8224

CVSS3: 7.8

debian

больше 6 лет назад

A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arb ...

GHSA-79jq-9hhm-7rfm

CVSS3: 7.8

github

больше 4 лет назад

A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL config into a fixed directory.

ALT-PU-2020-2776

CVSS3: 7.8

altlinux

около 6 лет назад

ALT-PU-2020-2776: package `nextcloud-client` update to version 3.0.1-alt1

EPSS

Процентиль: 52%

0.00662

Низкий

7.8 High

CVSS3

4.6 Medium

CVSS2

Дефекты

CWE-94