Server-Side Request Forgery in Nextcloud Server Versions
CVE-2020-8138

6.5MEDIUM

Key Information:

Vendor

Nextcloud
Status
Nextcloud Server
Vendor
CVE Published:
20 March 2020

What is CVE-2020-8138?

A critical vulnerability exists in Nextcloud Server that allows a malicious user to exploit a missing check for IPv4 addresses nested within IPv6. This flaw, present in versions prior to 17.0.1, 16.0.7, and 15.0.14, can be triggered by subscribing to a harmful calendar URL. When exploited, this vulnerability may permit an attacker to send unauthorized requests from the server, potentially leading to data leaks or further system compromises.

Affected Version(s)

Nextcloud Server Fixed in 17.0.2, 16.0.7, and 15.0.14

References

https://hackerone.com/reports/736867
x_refsource_MISC
https://nextcloud.com/security/advisory/?id=NC-SA-2020-014
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2020-8138 : Server-Side Request Forgery in Nextcloud Server Versions