Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2016-9460: Nextcloud and ownCloud files app may show fake messages
CVE-2016-9460 · published 9 years ago
Summary
The files web interface in older versions of Nextcloud (before 9.0.52) and ownCloud (before 9.0.4) can be tricked into displaying a false error message created by an attacker. This happens because the address bar does not properly check the information it receives. Update the servers to the latest version to stop this from being possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| nextcloud | nextcloud |
<= 9.0.51 cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:* |
| owncloud | owncloud |
<= 9.0.3 cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:* |
Original advisory text
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app was not verifying the passed parameters...
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.
References
- http://www.securityfocus.com/bid/97282
- https://github.com/nextcloud/server/commit/2da43e3751576bbc838f238a09955c4dcdebe... Issue Tracking Patch Third Party Advisory
- https://hackerone.com/reports/145463 Exploit Third Party Advisory
- https://github.com/nextcloud/server/commit/8aa0832bd449c44ec300da4189bd8ed4e0361... Issue Tracking Patch Third Party Advisory
- https://github.com/nextcloud/server/commit/dea8e29289a1b99d5e889627c2e377887f4f2... Issue Tracking Patch Third Party Advisory
- https://github.com/owncloud/core/commit/c92c234059f8b1dc7d53122985ec0d398895a2cf Issue Tracking Patch Third Party Advisory
- https://nextcloud.com/security/advisory/?id=nc-sa-2016-003 Patch Vendor Advisory
- https://owncloud.org/security/advisory/?id=oc-sa-2016-013 Patch Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-451User Interface (UI) Misrepresentation of Critical Information
CWE-284Improper Access Control
Timeline
Published28 Mar 2017
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2016-9460 · NVD
Track software like this
Free during beta