CVE-2016-9467

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-9467
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-9467.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-9467
Published
2017-03-28T02:59:01.153Z
Modified
2026-07-08T12:29:00.485507Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.

References

Affected packages

Git / github.com/nextcloud/server

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
36750094f8b1a2f3bb24ac46348a639fc6197f9c
Introduced
43ce8b13c1422ed82f42886b5918159f05b36967
Fixed
12ec1d1e3e5d90140e2afaca8afc3727dadeca1a
Fixed
1352365e8bf5ea49da3dc82b1ccf7ddb659ae960
Fixed
5dd211cc8845fd4533966bf8d7a7f2a6359ea013
Fixed
778ae8abd54c378fc4781394bbedc7a2ee3095e1
Fixed
c3ae21fef2880c9fe44e8fdbe1262ac7f9716f14
Fixed
df50e967dbd27b13875625b7dd3189294619b071
Fixed
ed0f0db5fa0aff04594cb0f973ae4c22b17a175a
Database specific 
{
    "cpe": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "9.0.54"
        },
        {
            "introduced": "10.0.0"
        },
        {
            "fixed": "10.0.1"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0beta1
v10.*
v10.0.0
v10.0.1RC1
v3.*
v3.0
v4.*
v4.0.0
v4.0.0RC
v4.0.0RC2
v4.0.0beta
v4.0.1
v4.0.4
v4.0.5
v4.0.6
v4.5.0
v4.5.0RC1
v4.5.0RC2
v4.5.0RC3
v4.5.0beta3
v4.5.0beta4
v5.*
v5.0.0
v5.0.0RC1
v5.0.0RC2
v5.0.0RC3
v5.0.0alpha1
v5.0.0beta1
v5.0.0beta2
v6.*
v6.0.0RC1
v6.0.0RC2
v6.0.0alpha2
v6.0.0beta2
v6.0.0beta3
v6.0.0beta4
v6.0.0beta5
v7.*
v7.0.0alpha2
v7.0.0beta1
v8.*
v8.0.0
v8.0.0RC1
v8.0.0RC2
v8.0.0alpha1
v8.0.0alpha2
v8.0.0beta1
v8.0.0beta2
v8.1.0alpha1
v8.1.0alpha2
v8.1.0beta1
v8.1.0beta2
v8.1RC2
v8.2RC1
v8.2beta1
v9.*
v9.0.0
v9.0.0RC1
v9.0.0RC2
v9.0.0RC3
v9.0.0beta2
v9.0.1
v9.0.1RC1
v9.0.1RC2
v9.0.1beta
v9.0.2
v9.0.2RC1
v9.0.2RC2
v9.0.50
v9.0.51
v9.0.52
v9.0.52RC1
v9.0.54RC1
v9.0beta1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-9467.json"

Git / github.com/owncloud/core

Affected ranges

Type
GIT
Repo
https://github.com/owncloud/core
Events
Introduced
81f694d83e8246d9b6482b773c8bdca675c51828
Fixed
eac87d3dd56303575746cfae6382d609bd51ff6e
Introduced
b642b26f7229c99b33e49cde86b38fdc6e8e5f21
Fixed
d47c589b0429eafa5add3a9ffc1c89f8ecccf9cc
Fixed
768221fcf3c526c65d85f62b0efa2da5ea00bf2d
Fixed
e7acbce27fa0ef1c6fe216ca67c72d86484919a4
Database specific 
{
    "cpe": "cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.0.6"
        },
        {
            "introduced": "9.1.0"
        },
        {
            "fixed": "9.1.2"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v9.*
v9.0.0
v9.0.1
v9.0.1RC1
v9.0.1RC2
v9.0.1beta
v9.0.2
v9.0.2RC1
v9.0.2RC2
v9.0.3
v9.0.3RC1
v9.0.4
v9.0.4RC1
v9.0.5
v9.0.5RC1
v9.0.5RC2
v9.0.6RC1
v9.0.6RC2
v9.1.0
v9.1.1
v9.1.1RC1
v9.1.1RC2
v9.1.1RC3
v9.1.2RC1
v9.1.2RC2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-9467.json"