Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to…

Published 9 y ago 2017-05-08 · modified 4 mo ago 2026-06-17 · JSON

CVSS

3.5

v3.1 · NVD

CISA KEV

not known exploited

EPSS

1.0%

percentile 63%

Public exploits

none known

Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to the files access to the users file.

Exploit prediction (EPSS)

0.98% probability of exploitation in the next 30 days, higher than 63% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.1	3.5	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:P/I:N/A:N`

Affected products

Nextcloud Nextcloud Server

Classification

Weakness

CWE-285 Improper Authorization
CWE-384 Session Fixation

References

hackerone.com /reports/191979 · x_refsource_MISC, x_transferred
nextcloud.com /security/advisory/?id=nc-sa-2017-009 · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2017-0892
NVD: CVE-2017-0892

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.