Описание
Security update for nextcloud
This update for nextcloud fixes the following issues:
Security issue fixed:
- CVE-2017-0936: Nextcloud Server before 11.0.7 suffers from an Authorization Bypass Through User-Controlled Key vulnerability (boo#1087402).
Bug fixes:
- See online release notes for all relevant changes. https://nextcloud.com/changelog/
Список пакетов
openSUSE Leap 42.3
nextcloud-13.0.1-6.1
Ссылки
- E-Mail link for openSUSE-SU-2018:1040-1
- SUSE Security Ratings
Описание
Nextcloud Server before 11.0.7 and 12.0.5 suffers from an Authorization Bypass Through User-Controlled Key vulnerability. A missing ownership check allowed logged-in users to change the scope of app passwords of other users. Note that the app passwords themselves where neither disclosed nor could the error be misused to identify as another user.
Затронутые продукты
openSUSE Leap 42.3:nextcloud-13.0.1-6.1
Ссылки
- CVE-2017-0936
- SUSE Bug 1087402