An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint.

Update to Nextcloud 18.0.9, fixes CVE-2020-81-39, CVE-2020-8173, CVE-2020-8183, CVE-2020-8223, CVE-2020-8154, CVE-2020-8155.

Updating the Mail & Groupfolders apps from within Nextcloud also fixes CVE-2020-8153, CVE-2020-8156

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nextcloud fixes the following issues :

nextcloud version 20.0.0 fix some security issues :

  - NC-SA-2020-037 PIN for passwordless WebAuthm is asked     for but not verified

  - NC-SA-2020-033 (CVE-2020-8228) Missing rate limit on     signup page

  - NC-SA-2020-029 (CVE-2020-8233, boo#1177346) Re-Sharing     allows increase of privileges

  - NC-SA-2020-026 Passowrd of share by mail is not hashed     when given on the create share call

  - NC-SA-2020-023 Increase random used for encryption

  - Update to 19.0.3

  - Fix possible leaking scope in Flow (server#22410)

  - Combine body-login rules in theming and fix twofactor     and guest styling on bright colors (server#22427)

  - Show better quota warning for group folders and external     storage (server#22442)

  - Add php docs build script (server#22448)

  - Fix clicks on actions menu of non opaque file rows in     acceptance tests (server#22503)

  - Fix writing BLOBs to postgres with recent contacts     interaction (server#22515)

  - Set the mount id before calling storage wrapper     (server#22519)

  - Fix S3 error handling (server#22521)

  - Only disable zip64 if the size is known (server#22537)

  - Change free space calculation (server#22553)

  - Do not keep the part file if the forbidden exception has     no retry set (server#22560)

  - Fix app password updating out of bounds (server#22569)

  - Use the correct root to determinate the webroot for the     resource (server#22579)

  - Upgrade icewind/smb to 3.2.7 (server#22581)

  - Bump elliptic from 6.4.1 to 6.5.3 (notifications#732)

  - Fixes regression that prevented you from toggling the     encryption flag (privacy#489)

  - Match any non-whitespace character in filesystem pattern     (serverinfo#229)

  - Catch StorageNotAvailable exceptions (text#1001)

  - Harden read only check on public endpoints (text#1017)

  - Harden check when using token from memcache (text#1020)

  - Sessionid is an int (text#1029)

  - Only overwrite Ctrl-f when text is focussed (text#990)

  - Set the X-Requested-With header on dav requests     (viewer#582)

  - Update to 19.0.2

  - [stable19] lower minimum search length to 2 characters     (server#21782)

  - [stable19] Call openssl_pkey_export with $config and log     errors. (server#21804)

  - [stable19] Improve error reporting on sharing errors     (server#21806)

  - [stable19] Do not log RequestedRangeNotSatisfiable     exceptions in DAV (server#21840)

  - [stable19] Fix parsing of language code (server#21857)

  - [stable19] fix typo in revokeShare() (server#21876)

  - [stable19] Discourage webauthn user interaction     (server#21917)

  - [stable19] Encryption is ready if master key is enabled     (server#21935)

  - [stable19] Disable fragile comments tests (server#21939)

  - [stable19] Do not double encode the userid in webauthn     login (server#21953)

  - [stable19] update icewind/smb to 3.2.6 (server#21955)

  - [stable19] Respect default share permissions     (server#21967)

  - [stable19] allow admin to configure the max trashbin     size (server#21975)

  - [stable19] Fix risky test in twofactor_backupcodes     (server#21978)

  - [stable19] Fix PHPUnit deprecation warnings     (server#21981)

  - [stable19] fix moving files from external storage to     object store trashbin (server#21983)

  - [stable19] Ignore whitespace in sharing by mail     (server#21991)

  - [stable19] Properly fetch translation for remote wipe     confirmation dialog (server#22036)

  - [stable19] parse_url returns null in case a parameter is     not found (server#22044)

  - Bump elliptic from 6.5.2 to 6.5.3 (server#22050)

  - [stable19] Correctly remove usergroup shares on removing     group members (server#22053)

  - [stable19] Fix height to big for iPhone when using many     apps (server#22064)

  - [stable19] reset the cookie internally in new API when     abandoning paged results op (server#22069)

  - [stable19] Add Guzzle's InvalidArgumentException     (server#22070)

  - [stable19] contactsmanager shall limit number of results     early (server#22091)

  - [stable19] Fix browser freeze on long password input     (server#22094)

  - [stable19] Search also the email and displayname in user     mangement for groups (server#22118)

  - [stable19] Ensured large image is unloaded from memory     when generating previews (server#22121)

  - [stable19] fix display of remote users in incoming share     notifications (server#22131)

  - [stable19] Reuse cache for directory mtime/size if     filesystem changes can be ignored (server#22171)

  - [stable19] Remove unexpected argument (server#22178)

  - [stable19] Do not exit if available space cannot be     determined on file transfer (server#22181)

  - [stable19] Fix empty 'more' apps navigation after     installing an app (server#22183)

  - [stable19] Fix default log_rotate_size in     config.sample.php (server#22192)

  - [stable19] shortcut in reading nested group members when     IN_CHAIN is available (server#22203)

  - [stable19] Fix chmod on file descriptor (server#22208)

  - [stable19] Do clearstatcache() on rmdir (server#22209)

  - [stable19] SSE enhancement of file signature     (server#22210)

  - [stable19] remove logging message carrying no valuable     information (server#22215)

  - [stable19] Add app config option to disable 'Email was     changed by admin' activity (server#22232)

  - [stable19] Delete chunks if the move on an upload failed     (server#22239)

  - [stable19] Silence duplicate session warnings     (server#22247)

  - [3rdparty] Doctrine: Fix unquoted stmt fragments     backslash escaping (server#22252)

  - [stable19] Allow to disable share emails (server#22300)

  - [stable19] Show disabled user count in occ user:report     (server#22302)

  - Bump 3rdparty to last stable19 commit (server#22303)

  - [stable19] fixing a logged deprecation message     (server#22309)

  - [stable19] CalDAV: Add ability to limit sharing to owner     (server#22333)

  - [stable19] Only copy the link when updating a share or     no password was forced (server#22337)

  - [stable19] Remove encryption option for nextcloud     external storage (server#22341)

  - [stable19] l10n:Correct appid for WebAuthn     (server#22348)

  - [stable19] Properly search for users when limittogroups     is enabled (server#22355)

  - [stable19] SSE: make legacy format opt in (server#22381)

  - [stable19] Update the CRL (server#22387)

  - [stable19] Fix missing FN from federated contact     (server#22400)

  - [stable19] fix event icon sizes and text alignment     (server#22414)

  - [stable19] Bump stecman/symfony-console-completion from     0.8.0 to 0.11.0 (3rdparty#457)

  - [stable19] Add Guzzle's InvalidArgumentException     (3rdparty#474)

  - [stable19] Doctrine: Fix unquoted stmt fragments     backslash escaping (3rdparty#486)

  - [stable19] Fix cypress (viewer#545)

  - Move to webpack vue global config & bump deps     (viewer#558)

  - Update to 19.0.1

  - Security update Fix (CVE-2020-8183, NC-SA-2020-026,     CWE-256) A logic error in Nextcloud Server 19.0.0 caused     a plaintext storage of the share password when it was     given on the initial create API call.

  - Update to 19.0.0

  - Changes Nextcloud Hub v19, code name &ldquo;home     office&rdquo;, represents a big step forward for remote     collaboration in teams. This release brings document     collaboration to video chats, introduces password-less     login and improves performance. As this is a major     release, the changelog is too long to put here. Users     can look at github milestones to find what has been     merged. A quick overview of what is new :

  - password-less authentication and many other security     measures

  - Talk 9 with built-in office document editing courtesy of     Collabora, a grid view & more

  - MUCH improved performance, Deck integration in Calendar,     guest account groups and more!

This update for nextcloud to 18.0.4 fixes the following issues :

Security issues fixed :

  - CVE-2020-8154: Fixed an XSS vulnerability when opening     malicious PDFs (NC-SA-2020-018 boo#1171579).

  - CVE-2020-8155: Fixed a direct object reference     vulnerability that allowed attackers to remotely wipe     devices of other users (NC-SA-2020-019 boo#1171572).

ID	Name	Product	Family	Severity
141550	Fedora 32 : nextcloud (2020-c9863904de)	Nessus	Fedora Local Security Checks	high
141387	openSUSE Security Update : nextcloud (openSUSE-2020-1652)	Nessus	SuSE Local Security Checks	high
136872	openSUSE Security Update : nextcloud (openSUSE-2020-670)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2020-8154

high

Tenable Plugins

high

high

medium