SB2020091501 - Gentoo update for Nextcloud Desktop Sync client

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020091501

SB2020091501 - Gentoo update for Nextcloud Desktop Sync client

Published: September 15, 2020

Security Bulletin ID SB2020091501
Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Cross-site scripting (CVE-ID: CVE-2020-8189)

The vulnerability allows a remote authenticated user to read and manipulate data.

A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invalid data on the login attempt.


2) Code Injection (CVE-ID: CVE-2020-8224)

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation when processing OpenSSL configuration file. A remote user can upload a malicious OpenSSL config file into a fixed directory and execute arbitrary code on the system.



3) Path traversal (CVE-ID: CVE-2020-8227)

The vulnerability allows a remote privileged user to execute arbitrary code.

Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud Server to store files outside of the dedicated sync directory.


Remediation

Install update from vendor's website.

References