opensuse-su-2020:0220-1
Vulnerability from csaf_opensuse
Published
2020-02-15 19:09
Modified
2020-02-15 19:09
Summary
Security update for nextcloud

Notes

Title of the patch
Security update for nextcloud
Description of the patch
This update for nextcloud fixes the following issues: Nextcloud was updated to 15.0.14: - NC-SA-2020-002, CVE-2019-15613: workflow rules to depend their behaviour on the file extension when checking file mimetypes (boo#1162766) - NC-SA-2019-016, CVE-2019-15623: Exposure of Private Information caused the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled (boo#1162775) - NC-SA-2019-015, CVE-2019-15624: Improper Input Validation allowed group admins to create users with IDs of system folders (boo#1162776) - NC-SA-2019-012, CVE-2020-8119: Improper authorization caused leaking of previews and files when a file-drop share link is opened via the gallery app (boo#1162781) - NC-SA-2019-014, CVE-2020-8118: An authenticated server-side request forgery allowed to detect local and remote services when adding a new subscription in the calendar application (boo#1162782) - NC-SA-2020-012, CVE-2019-15621: Improper permissions preservation causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link (boo#1162784) - To many changes. For detail see: https://nextcloud.com/changelog/ nextcloud was updated to 13.0.12: - Fix NC-SA-2020-001 - To many changes. For detail see: https://nextcloud.com/changelog/
Patchnames
openSUSE-2020-220
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nextcloud",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nextcloud fixes the following issues:\n\nNextcloud was updated to 15.0.14:\n\n- NC-SA-2020-002, CVE-2019-15613: workflow rules to depend their behaviour on the file extension when checking file mimetypes  (boo#1162766)\n- NC-SA-2019-016, CVE-2019-15623: Exposure of Private Information caused the server to send it\u0027s domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled (boo#1162775)\n- NC-SA-2019-015, CVE-2019-15624: Improper Input Validation allowed group admins to create users with IDs of system folders (boo#1162776)\n- NC-SA-2019-012, CVE-2020-8119: Improper authorization caused leaking of previews and files when a file-drop share link is opened via the gallery app (boo#1162781)\n- NC-SA-2019-014, CVE-2020-8118: An authenticated server-side request forgery allowed to detect local and remote services when adding a new subscription in the calendar application (boo#1162782)\n- NC-SA-2020-012, CVE-2019-15621: Improper permissions preservation causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link (boo#1162784)\n- To many changes.\n   For detail see: https://nextcloud.com/changelog/\n\nnextcloud was updated to 13.0.12:\n\n- Fix NC-SA-2020-001\n- To many changes.\n    For detail see: https://nextcloud.com/changelog/\n\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2020-220",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_0220-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2020:0220-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4ZKAQ7AEGBUT5BPIHKS2AN3QK2XYBODP/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2020:0220-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4ZKAQ7AEGBUT5BPIHKS2AN3QK2XYBODP/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1162766",
        "url": "https://bugzilla.suse.com/1162766"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1162775",
        "url": "https://bugzilla.suse.com/1162775"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1162776",
        "url": "https://bugzilla.suse.com/1162776"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1162781",
        "url": "https://bugzilla.suse.com/1162781"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1162782",
        "url": "https://bugzilla.suse.com/1162782"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1162784",
        "url": "https://bugzilla.suse.com/1162784"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-15613 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-15613/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-15621 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-15621/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-15623 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-15623/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-15624 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-15624/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8118 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8118/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8119 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8119/"
      }
    ],
    "title": "Security update for nextcloud",
    "tracking": {
      "current_release_date": "2020-02-15T19:09:47Z",
      "generator": {
        "date": "2020-02-15T19:09:47Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2020:0220-1",
      "initial_release_date": "2020-02-15T19:09:47Z",
      "revision_history": [
        {
          "date": "2020-02-15T19:09:47Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nextcloud-15.0.14-bp151.3.3.1.noarch",
                "product": {
                  "name": "nextcloud-15.0.14-bp151.3.3.1.noarch",
                  "product_id": "nextcloud-15.0.14-bp151.3.3.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Package Hub 12",
                "product": {
                  "name": "SUSE Package Hub 12",
                  "product_id": "SUSE Package Hub 12",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:packagehub:12"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Package Hub 15",
                "product": {
                  "name": "SUSE Package Hub 15",
                  "product_id": "SUSE Package Hub 15"
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Package Hub 15 SP1",
                "product": {
                  "name": "SUSE Package Hub 15 SP1",
                  "product_id": "SUSE Package Hub 15 SP1"
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.1",
                "product": {
                  "name": "openSUSE Leap 15.1",
                  "product_id": "openSUSE Leap 15.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nextcloud-15.0.14-bp151.3.3.1.noarch as component of SUSE Package Hub 12",
          "product_id": "SUSE Package Hub 12:nextcloud-15.0.14-bp151.3.3.1.noarch"
        },
        "product_reference": "nextcloud-15.0.14-bp151.3.3.1.noarch",
        "relates_to_product_reference": "SUSE Package Hub 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nextcloud-15.0.14-bp151.3.3.1.noarch as component of SUSE Package Hub 15",
          "product_id": "SUSE Package Hub 15:nextcloud-15.0.14-bp151.3.3.1.noarch"
        },
        "product_reference": "nextcloud-15.0.14-bp151.3.3.1.noarch",
        "relates_to_product_reference": "SUSE Package Hub 15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nextcloud-15.0.14-bp151.3.3.1.noarch as component of SUSE Package Hub 15 SP1",
          "product_id": "SUSE Package Hub 15 SP1:nextcloud-15.0.14-bp151.3.3.1.noarch"
        },
        "product_reference": "nextcloud-15.0.14-bp151.3.3.1.noarch",
        "relates_to_product_reference": "SUSE Package Hub 15 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nextcloud-15.0.14-bp151.3.3.1.noarch as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:nextcloud-15.0.14-bp151.3.3.1.noarch"
        },
        "product_reference": "nextcloud-15.0.14-bp151.3.3.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-15613",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-15613"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:nextcloud-15.0.14-bp151.3.3.1.noarch",
          "SUSE Package Hub 15 SP1:nextcloud-15.0.14-bp151.3.3.1.noarch",
          "SUSE Package Hub 15:nextcloud-15.0.14-bp151.3.3.1.noarch",
          "openSUSE Leap 15.1:nextcloud-15.0.14-bp151.3.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-15613",
          "url": "https://www.suse.com/security/cve/CVE-2019-15613"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1162766 for CVE-2019-15613",
          "url": "https://bugzilla.suse.com/1162766"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "SUSE Package Hub 15 SP1:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "SUSE Package Hub 15:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "openSUSE Leap 15.1:nextcloud-15.0.14-bp151.3.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "SUSE Package Hub 15 SP1:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "SUSE Package Hub 15:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "openSUSE Leap 15.1:nextcloud-15.0.14-bp151.3.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-02-15T19:09:47Z",
          "details": "important"
        }
      ],
      "title": "CVE-2019-15613"
    },
    {
      "cve": "CVE-2019-15621",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-15621"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:nextcloud-15.0.14-bp151.3.3.1.noarch",
          "SUSE Package Hub 15 SP1:nextcloud-15.0.14-bp151.3.3.1.noarch",
          "SUSE Package Hub 15:nextcloud-15.0.14-bp151.3.3.1.noarch",
          "openSUSE Leap 15.1:nextcloud-15.0.14-bp151.3.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-15621",
          "url": "https://www.suse.com/security/cve/CVE-2019-15621"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1162784 for CVE-2019-15621",
          "url": "https://bugzilla.suse.com/1162784"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "SUSE Package Hub 15 SP1:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "SUSE Package Hub 15:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "openSUSE Leap 15.1:nextcloud-15.0.14-bp151.3.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "SUSE Package Hub 15 SP1:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "SUSE Package Hub 15:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "openSUSE Leap 15.1:nextcloud-15.0.14-bp151.3.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-02-15T19:09:47Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-15621"
    },
    {
      "cve": "CVE-2019-15623",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-15623"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it\u0027s domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:nextcloud-15.0.14-bp151.3.3.1.noarch",
          "SUSE Package Hub 15 SP1:nextcloud-15.0.14-bp151.3.3.1.noarch",
          "SUSE Package Hub 15:nextcloud-15.0.14-bp151.3.3.1.noarch",
          "openSUSE Leap 15.1:nextcloud-15.0.14-bp151.3.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-15623",
          "url": "https://www.suse.com/security/cve/CVE-2019-15623"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1162775 for CVE-2019-15623",
          "url": "https://bugzilla.suse.com/1162775"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "SUSE Package Hub 15 SP1:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "SUSE Package Hub 15:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "openSUSE Leap 15.1:nextcloud-15.0.14-bp151.3.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "SUSE Package Hub 15 SP1:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "SUSE Package Hub 15:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "openSUSE Leap 15.1:nextcloud-15.0.14-bp151.3.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-02-15T19:09:47Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-15623"
    },
    {
      "cve": "CVE-2019-15624",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-15624"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:nextcloud-15.0.14-bp151.3.3.1.noarch",
          "SUSE Package Hub 15 SP1:nextcloud-15.0.14-bp151.3.3.1.noarch",
          "SUSE Package Hub 15:nextcloud-15.0.14-bp151.3.3.1.noarch",
          "openSUSE Leap 15.1:nextcloud-15.0.14-bp151.3.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-15624",
          "url": "https://www.suse.com/security/cve/CVE-2019-15624"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1162776 for CVE-2019-15624",
          "url": "https://bugzilla.suse.com/1162776"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "SUSE Package Hub 15 SP1:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "SUSE Package Hub 15:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "openSUSE Leap 15.1:nextcloud-15.0.14-bp151.3.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "SUSE Package Hub 15 SP1:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "SUSE Package Hub 15:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "openSUSE Leap 15.1:nextcloud-15.0.14-bp151.3.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-02-15T19:09:47Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-15624"
    },
    {
      "cve": "CVE-2020-8118",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8118"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when adding a new subscription in the calendar application.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:nextcloud-15.0.14-bp151.3.3.1.noarch",
          "SUSE Package Hub 15 SP1:nextcloud-15.0.14-bp151.3.3.1.noarch",
          "SUSE Package Hub 15:nextcloud-15.0.14-bp151.3.3.1.noarch",
          "openSUSE Leap 15.1:nextcloud-15.0.14-bp151.3.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8118",
          "url": "https://www.suse.com/security/cve/CVE-2020-8118"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1162782 for CVE-2020-8118",
          "url": "https://bugzilla.suse.com/1162782"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "SUSE Package Hub 15 SP1:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "SUSE Package Hub 15:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "openSUSE Leap 15.1:nextcloud-15.0.14-bp151.3.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "SUSE Package Hub 15 SP1:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "SUSE Package Hub 15:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "openSUSE Leap 15.1:nextcloud-15.0.14-bp151.3.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-02-15T19:09:47Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-8118"
    },
    {
      "cve": "CVE-2020-8119",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8119"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the gallery app.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 12:nextcloud-15.0.14-bp151.3.3.1.noarch",
          "SUSE Package Hub 15 SP1:nextcloud-15.0.14-bp151.3.3.1.noarch",
          "SUSE Package Hub 15:nextcloud-15.0.14-bp151.3.3.1.noarch",
          "openSUSE Leap 15.1:nextcloud-15.0.14-bp151.3.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8119",
          "url": "https://www.suse.com/security/cve/CVE-2020-8119"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1162781 for CVE-2020-8119",
          "url": "https://bugzilla.suse.com/1162781"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 12:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "SUSE Package Hub 15 SP1:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "SUSE Package Hub 15:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "openSUSE Leap 15.1:nextcloud-15.0.14-bp151.3.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 12:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "SUSE Package Hub 15 SP1:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "SUSE Package Hub 15:nextcloud-15.0.14-bp151.3.3.1.noarch",
            "openSUSE Leap 15.1:nextcloud-15.0.14-bp151.3.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-02-15T19:09:47Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-8119"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.