CVE-2017-0888

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Content-Spoofing vulnerability in the "files" app. The top navigation bar displayed in the files list contained partially user-controllable input leading to a potential misrepresentation of information.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-451 CWE-20

Affected software

Vendor	Product	Versions
Nextcloud	Nextcloud Server	All versions before 9.0.55 and 10.0.2

References

http://www.securityfocus.com/bid/97491Third Party Advisory, VDB Entry
https://hackerone.com/reports/179073Third Party Advisory
https://nextcloud.com/security/advisory/?id=nc-sa-2017-006Patch, Vendor Advisory
http://www.securityfocus.com/bid/97491Third Party Advisory, VDB Entry
https://hackerone.com/reports/179073Third Party Advisory
https://nextcloud.com/security/advisory/?id=nc-sa-2017-006Patch, Vendor Advisory

Timeline

Published: Apr 5, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-08899.8Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter clas CVE-2017-08905.4Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitabl CVE-2017-08915.4Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are vulnerable to an inadequate escaping of error messages leading to XSS vulnerabiliti CVE-2017-08923.5Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to CVE-2017-08935.4Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are shipping a vulnerable JavaScript library for sanitizing untrusted user-input which CVE-2017-08944.3Nextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public calendars due to a logical error. Thus granting CVE-2017-08953.5Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that CVE-2017-08966.5Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat applica CVE-2017-08977.5ExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with weak entropy. Successfully guessing the to CVE-2017-08989.1Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus val CVE-2017-08999.8RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printin CVE-2017-09007.5RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against Ruby