Unscored CVE-2020-8152 EUVD-2020-29045GHSA-wh9j-q6hg-x337

Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the public key to decr…

Published Nov 16, 2020 · Updated Aug 4, 2024 · Assigned by hackerone

Description

Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the public key to decrypt them later on.

Affected products

Vendor	Product	Affected	Fixed
—	Nextcloud Server	Fixed in 20.0.0	—

References

https://hackerone.com/reports/743505
https://nextcloud.com/security/advisory/?id=NC-SA-2020-040
20201225 Re: [FD] CVE-2020-8152 - Elevation of Privilege in Backblaze mailing-list