VulnerabilityModified
CVE-2020-8293
A missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to store unlimited data in workflow rules causing load and potential DDoS on later interactions and usage with those rules.
MEDIUM 6.5EPSS 1.56%
Does this matter?
Lower severity and a low EPSS score (1.56%). Track it; it rarely justifies an emergency change on its own.
Description
A missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to store unlimited data in workflow rules causing load and potential DDoS on later interactions and usage with those rules.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 1.56% probability · 74th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-400
- Affected
- nextcloud/nextcloud server
- Source
- support@hackerone.com
References
- https://hackerone.com/reports/1018146Third Party Advisory
- https://nextcloud.com/security/advisory/?id=NC-SA-2021-001Broken Link, Vendor Advisory
- https://hackerone.com/reports/1018146Third Party Advisory
- https://nextcloud.com/security/advisory/?id=NC-SA-2021-001Broken Link, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.