Vulnerability Report

CVE-2016-9459

Title: Owncloud Cross-Site Scripting (XSS)

XSS

Proof Of Concept

No public PoC currently indexed for CVE-2016-9459.

CWE Category CWE-79

Published Date Mar 28, 2017

Modified Date May 13, 2026

Exploit Status Not Found

Score 6.1 CVSS v3.0

Exploit Probability (EPSS)

0.49%

Vulnerability Summary

CVE-2016-9459: Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download log functionality in the admin screen is delivering the log in JSON format to the end-user. The file was delivered with an attachment disposition forcing the browser to download the document. However, Firefox running on Microsoft Windows would offer the user to open the data in the browser as an HTML document. Thus any injected data in the log would be executed.

Impacted Vendors

owncloud 1

nextcloud 1

Reference Links

http://www.securityfocus.com/bid/97284 https://github.com/nextcloud/server/commit/94975af6db1551c2d23136c2ea22866a5b416070 https://github.com/owncloud/core/commit/044ee072a647636b1a17c89265c7233b35371335 https://github.com/owncloud/core/commit/b7fa2c5dc945b40bc6ed0a9a0e47c282ebf043e1 https://github.com/owncloud/core/commit/efa35d621dc7ff975468e636a5d1c153511296dc https://hackerone.com/reports/146278 https://nextcloud.com/security/advisory/?id=nc-sa-2016-002 https://owncloud.org/security/advisory?id=oc-sa-2016-012 http://www.securityfocus.com/bid/97284 https://github.com/nextcloud/server/commit/94975af6db1551c2d23136c2ea22866a5b416070 https://github.com/owncloud/core/commit/044ee072a647636b1a17c89265c7233b35371335 https://github.com/owncloud/core/commit/b7fa2c5dc945b40bc6ed0a9a0e47c282ebf043e1 https://github.com/owncloud/core/commit/efa35d621dc7ff975468e636a5d1c153511296dc https://hackerone.com/reports/146278 https://nextcloud.com/security/advisory/?id=nc-sa-2016-002 https://owncloud.org/security/advisory?id=oc-sa-2016-012

CVSS v3.0

Source Entity [email protected]

Severity MEDIUM

6.1

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

4.3

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:M/Au:N/C:N/I:P/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns