CVE - CVE-2016-9459

CVE-ID
CVE-2016-9459	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download log functionality in the admin screen is delivering the log in JSON format to the end-user. The file was delivered with an attachment disposition forcing the browser to download the document. However, Firefox running on Microsoft Windows would offer the user to open the data in the browser as an HTML document. Thus any injected data in the log would be executed.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:97284 URL:http://www.securityfocus.com/bid/97284 MISC:https://github.com/nextcloud/server/commit/94975af6db1551c2d23136c2ea22866a5b416070 MISC:https://github.com/owncloud/core/commit/044ee072a647636b1a17c89265c7233b35371335 MISC:https://github.com/owncloud/core/commit/b7fa2c5dc945b40bc6ed0a9a0e47c282ebf043e1 MISC:https://github.com/owncloud/core/commit/efa35d621dc7ff975468e636a5d1c153511296dc MISC:https://hackerone.com/reports/146278 MISC:https://nextcloud.com/security/advisory/?id=nc-sa-2016-002 MISC:https://owncloud.org/security/advisory?id=oc-sa-2016-012
Assigning CNA
HackerOne
Date Record Created
20161119	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20161119)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)