NVD

Id
84029  
Name
CVE-2016-9463  
Description
Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authentication Bypass. Nextcloud/ownCloud include an optional and not by default enabled SMB authentication component that allows authenticating users against an SMB server. This backend is implemented in a way that tries to connect to a SMB server and if that succeeded consider the user logged-in. The backend did not properly take into account SMB servers that have any kind of anonymous auth configured. This is the default on SMB servers nowadays and allows an unauthenticated attacker to gain access to an account without valid credentials. Note: The SMB backend is disabled by default and requires manual configuration in the Nextcloud/ownCloud config file. If you have not configured the SMB backend then you"re not affected by this vulnerability.  
Reject
 
CVSS Version
 
CVSS Score
 
Severity
 
CVSS Base Score
 
CVSS Impact Subscore
 
CVSS Exploit Subscore
 
CVSS Vector
 
Pub Date
2017-03-29  
Published
2017-03-27  
Modified Date
2017-03-27  
Seq
2016-9463  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
412275 84029 CVE-2017-6392 96534  View
412276 84029 CVE-2017-6392 https://github.com/kaltura/server/commit/041a6d5e8336f7713985b120139c8f4b6279a337  View
412277 84029 CVE-2017-6392 https://github.com/kaltura/server/issues/5303  View

Related JVN