medium5.3
CVE-2019-15623
Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any furthe…
Impact
Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nextcloud | Nextcloud Server | before 14.0.13 from 15.0.0 before 15.0.9 from 16.0.0 before 16.0.2 |
| Opensuse | Backports Sle | Version 15.0 |
| Suse | Package Hub | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00019.html
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00022.html
- https://hackerone.com/reports/508490
- https://nextcloud.com/security/advisory/?id=NC-SA-2019-016
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00019.html
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00022.html
- https://hackerone.com/reports/508490
- https://nextcloud.com/security/advisory/?id=NC-SA-2019-016