CVE-2020-8154
Fixed in a distro release EPSS 2%
An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint.
Products: nextcloud_server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Package Hub 12 | nextcloud | 20.0.0-bp152.2.3.1 |
| SUSE Package Hub 12 | nextcloud | 18.0.4-22.1 |
| SUSE Package Hub 15 SP1 | nextcloud | 20.0.0-bp152.2.3.1 |
| SUSE Package Hub 15 SP1 | nextcloud | 18.0.4-bp151.3.9.1 |
| SUSE Package Hub 15 SP2 | nextcloud | 20.0.0-bp152.2.3.1 |
| openSUSE Leap 15.1 | nextcloud | 18.0.4-lp151.2.6.1 |
| openSUSE Leap 15.1 | nextcloud | 20.0.0-bp152.2.3.1 |
| openSUSE Leap 15.2 | nextcloud | 20.0.0-bp152.2.3.1 |