Unscored CVE-2018-3762 EUVD-2018-15568GHSA-6p7m-f494-cjvp

Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still …

Published Jul 5, 2018 · Updated Aug 5, 2024 · Assigned by hackerone

Vendor: Nextcloud Product: Nextcloud Server Category: Web / CMS

Description

Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still request previews for files it should not have access to.

Affected products

Vendor	Product	Affected	Fixed
Nextcloud	Nextcloud Server	<13.0.3, <12.0.8	—

References

https://nextcloud.com/security/advisory/?id=nc-sa-2018-002
https://hackerone.com/reports/358339