Description
Missing access control in Nextcloud Deck 1.0.4 caused an insecure direct object reference allowing an attacker to view all attachments.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Nextcloud Deck app | Fixed in 1.0.5 | — |
Unscored
CVE-2020-8235
EUVD-2020-29107GHSA-crm5-43pc-vrcg
Missing access control in Nextcloud Deck 1.0.4 caused an insecure direct object reference allowing an attacker to view all attachments.
Published Oct 5, 2020 · Updated Aug 4, 2024 · Assigned by hackerone