FKIE_CVE-2016-9465

Vulnerability from fkie_nvd - Published: 2017-03-28 02:59 - Updated: 2026-06-17 00:56
Severity
5.4 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image export functionality as implemented in Nextcloud/ownCloud allows the download of images stored within a vCard. Due to not performing any kind of verification on the image content this is prone to a stored Cross-Site Scripting attack.
References
support@hackerone.comhttps://github.com/nextcloud/server/commit/68ab8325c799d20c1fb7e98d670785176590e7d0Issue Tracking, Patch, Third Party Advisory
support@hackerone.comhttps://github.com/owncloud/core/commit/6bf3be3877d9d9fda9c66926fe273fe79cbaf58eIssue Tracking, Patch, Third Party Advisory
support@hackerone.comhttps://github.com/owncloud/core/commit/b5a5be24c418033cb2ef965a4f3f06b7b4213845Issue Tracking, Patch, Third Party Advisory
support@hackerone.comhttps://hackerone.com/reports/163338Exploit, Third Party Advisory
support@hackerone.comhttps://nextcloud.com/security/advisory/?id=nc-sa-2016-008Patch, Vendor Advisory
support@hackerone.comhttps://owncloud.org/security/advisory/?id=oc-sa-2016-018Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/nextcloud/server/commit/68ab8325c799d20c1fb7e98d670785176590e7d0Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/owncloud/core/commit/6bf3be3877d9d9fda9c66926fe273fe79cbaf58eIssue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/owncloud/core/commit/b5a5be24c418033cb2ef965a4f3f06b7b4213845Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://hackerone.com/reports/163338Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://nextcloud.com/security/advisory/?id=nc-sa-2016-008Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://owncloud.org/security/advisory/?id=oc-sa-2016-018Patch, Vendor Advisory
Impacted products
Vendor Product Version
nextcloud nextcloud_server *
owncloud owncloud *
owncloud owncloud *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Nextcloud Server \u0026 ownCloud Server Nextcloud Server before 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Nextcloud Server \u0026 ownCloud Server Nextcloud Server before 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2"
            }
          ]
        }
      ],
      "source": "support@hackerone.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8288B81D-CA35-46EB-A7E7-B60B193E3F81",
              "versionEndExcluding": "10.0.1",
              "versionStartIncluding": "10.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA8CCC5C-D019-4A80-BD8D-3914BFFC60C0",
              "versionEndExcluding": "9.0.6",
              "versionStartIncluding": "9.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E9501A9-E507-4A81-954B-D6D3223EE2F8",
              "versionEndExcluding": "9.1.2",
              "versionStartIncluding": "9.1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nextcloud Server before 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image export functionality as implemented in Nextcloud/ownCloud allows the download of images stored within a vCard. Due to not performing any kind of verification on the image content this is prone to a stored Cross-Site Scripting attack."
    },
    {
      "lang": "es",
      "value": "Nextcloud Server en versiones anteriores a 10.0.1 y ownCloud Server en versiones anteriores a 9.0.6 y 9.1.2 sufren de XSS almacenado en la exportaci\u00f3n de im\u00e1genes CardDAV. La funcionalidad de exportaci\u00f3n de im\u00e1genes CardDAV implementada en Nextcloud/ownCloud permite descargar im\u00e1genes almacenadas dentro de una vCard. Debido a que no realiza ning\u00fan tipo de verificaci\u00f3n en el contenido de la imagen, esto es propenso a un ataque de secuencias de comandos entre sitios."
    }
  ],
  "id": "CVE-2016-9465",
  "lastModified": "2026-06-17T00:56:07.393",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-03-28T02:59:01.043",
  "references": [
    {
      "source": "support@hackerone.com",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/nextcloud/server/commit/68ab8325c799d20c1fb7e98d670785176590e7d0"
    },
    {
      "source": "support@hackerone.com",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/owncloud/core/commit/6bf3be3877d9d9fda9c66926fe273fe79cbaf58e"
    },
    {
      "source": "support@hackerone.com",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/owncloud/core/commit/b5a5be24c418033cb2ef965a4f3f06b7b4213845"
    },
    {
      "source": "support@hackerone.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://hackerone.com/reports/163338"
    },
    {
      "source": "support@hackerone.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://nextcloud.com/security/advisory/?id=nc-sa-2016-008"
    },
    {
      "source": "support@hackerone.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://owncloud.org/security/advisory/?id=oc-sa-2016-018"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/nextcloud/server/commit/68ab8325c799d20c1fb7e98d670785176590e7d0"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/owncloud/core/commit/6bf3be3877d9d9fda9c66926fe273fe79cbaf58e"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/owncloud/core/commit/b5a5be24c418033cb2ef965a4f3f06b7b4213845"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://hackerone.com/reports/163338"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://nextcloud.com/security/advisory/?id=nc-sa-2016-008"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://owncloud.org/security/advisory/?id=oc-sa-2016-018"
    }
  ],
  "sourceIdentifier": "support@hackerone.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "support@hackerone.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.