CVE

Id
96281  
CVE No.
CVE-2016-9461  
Status
Candidate  
Description
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was not properly checking the permission on a WebDAV COPY action. This allowed an authenticated attacker with access to a read-only share to put new files in there. It was not possible to modify existing files.  
Phase
Assigned (20161119)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
800629 96281 CVE-2016-9461 MISC:https://github.com/nextcloud/server/commit/3491400261c1454a9a30d3ec96969573330120cc  View
800630 96281 CVE-2016-9461 MISC:https://github.com/owncloud/core/commit/0622e635d97cb17c5e1363e370bb8268cc3d2547  View
800631 96281 CVE-2016-9461 MISC:https://github.com/owncloud/core/commit/121a3304a0c37ccda0e1b63ddc528cba9121a36e  View
800632 96281 CVE-2016-9461 MISC:https://github.com/owncloud/core/commit/acbbadb71ceee7f01da347f7dcd519beda78cc47  View
800633 96281 CVE-2016-9461 MISC:https://github.com/owncloud/core/commit/c0a4b7b3f38ad2eaf506484b3b92ec678cb021c9  View
800634 96281 CVE-2016-9461 MISC:https://hackerone.com/reports/145950  View
800635 96281 CVE-2016-9461 MISC:https://nextcloud.com/security/advisory/?id=nc-sa-2016-004  View
800636 96281 CVE-2016-9461 MISC:https://owncloud.org/security/advisory/?id=oc-sa-2016-014  View
800637 96281 CVE-2016-9461 BID:97276  View

Related JVN