VULNERABILITY INTELLIGENCE

CVE-2016-9467

CVSS score5.3 MEDIUM
EPSS probability2.97%
CISA KEVNot currently listed
Published2017-03-28
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.

Weakness classification

  • CWE-284: Improper Access Control
  • CWE-451: User Interface (UI) Misrepresentation of Critical Information

Primary references