CVE-2016-9459

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-9459
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-9459.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-9459
Published
2017-03-28T02:59:00.730Z
Modified
2026-03-13T14:36:58.589892Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download log functionality in the admin screen is delivering the log in JSON format to the end-user. The file was delivered with an attachment disposition forcing the browser to download the document. However, Firefox running on Microsoft Windows would offer the user to open the data in the browser as an HTML document. Thus any injected data in the log would be executed.

References

Affected packages

Git / github.com/nextcloud/server

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6d9809ef452d73b53d3d70493d9a92ee64bd528f
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6f4931a085bcd26346bdfdf7c5a6f832df78d473
Fixed
94975af6db1551c2d23136c2ea22866a5b416070
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "9.0.52"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "9.0.4"
        }
    ]
}
Type
Repo
https://github.com/owncloud/core
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
044ee072a647636b1a17c89265c7233b35371335
Fixed
b7fa2c5dc945b40bc6ed0a9a0e47c282ebf043e1
Fixed
efa35d621dc7ff975468e636a5d1c153511296dc

Affected versions

Other
list
v1.*
v1.0.0beta1
v1.0RC1
v1.1
v2.*
v2.0beta3
v3.*
v3.0
v3.0RC1
v3.0alpha1
v4.*
v4.0.0
v4.0.0RC
v4.0.0RC2
v4.0.0beta
v4.0.1
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.5.0
v4.5.0RC1
v4.5.0RC2
v4.5.0RC3
v4.5.0beta1
v4.5.0beta2
v4.5.0beta3
v4.5.0beta4
v5.*
v5.0.0
v5.0.0RC1
v5.0.0RC2
v5.0.0RC3
v5.0.0alpha1
v5.0.0beta1
v5.0.0beta2
v6.*
v6.0.0RC1
v6.0.0RC2
v6.0.0alpha2
v6.0.0beta2
v6.0.0beta3
v6.0.0beta4
v6.0.0beta5
v7.*
v7.0.0alpha2
v7.0.0beta1
v8.*
v8.0.0
v8.0.0RC1
v8.0.0RC2
v8.0.0alpha1
v8.0.0alpha2
v8.0.0beta1
v8.0.0beta2
v8.1.0alpha1
v8.1.0alpha2
v8.1.0beta1
v8.1.0beta2
v8.1RC2
v8.2RC1
v8.2beta1
v9.*
v9.0.0
v9.0.0RC1
v9.0.0RC2
v9.0.0RC3
v9.0.0beta2
v9.0.1
v9.0.1RC1
v9.0.1RC2
v9.0.1beta
v9.0.2
v9.0.2RC1
v9.0.2RC2
v9.0.3
v9.0.3RC1
v9.0.50
v9.0.51
v9.0.52RC1
v9.0beta1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-9459.json"