Code Injection Vulnerability in Nextcloud Desktop Client for macOS
CVE-2020-8140

6.7MEDIUM

Key Information:

Vendor

Nextcloud
Status
Desktop Client
Vendor
CVE Published:
20 March 2020

What is CVE-2020-8140?

A vulnerability in the Nextcloud Desktop Client for macOS enables attackers to execute arbitrary code when the client is launched with the DYLD_INSERT_LIBRARIES environment variable set. This flaw could potentially allow unauthorized code to run within the client's process, exposing users to various risks. It is crucial to ensure that your Nextcloud Desktop Client is updated to mitigate the potential for exploitation. For further details, refer to the security advisory provided by Nextcloud.

Affected Version(s)

Desktop Client Fixed in 2.6.3

References

https://hackerone.com/reports/633266
x_refsource_MISC
https://nextcloud.com/security/advisory/?id=NC-SA-2020-016
x_refsource_CONFIRM

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.