CVEvulnerability
CVE-2019-15623
5.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2020-02-04
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-359
Description
Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled.
Affected configurations
• nextcloud nextcloud server (< 14.0.13)
• nextcloud nextcloud server (>= 15.0.0 < 15.0.9)
• nextcloud nextcloud server (>= 16.0.0 < 16.0.2)
• opensuse backports sle 15.0
• suse package hub
Related
Weakness · CWE (1)
- CWE-359 Exposure of Private Personal Information to an Unauthorized Actor weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00019.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00022.html Third Party Advisory
- https://hackerone.com/reports/508490 Exploit, Third Party Advisory
- https://nextcloud.com/security/advisory/?id=NC-SA-2019-016 Third Party Advisory, Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00019.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00022.html Third Party Advisory
- https://hackerone.com/reports/508490 Exploit, Third Party Advisory
- https://nextcloud.com/security/advisory/?id=NC-SA-2019-016 Third Party Advisory, Vendor Advisory