CVE-2020-8293

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to store unlimited data in workflow rules causing load and potential DDoS on later interactions and usage with those rules.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
n/a	Nextcloud Server	Fixed in 20.0.2, 19.0.5, 18.0.11

References

https://hackerone.com/reports/1018146Third Party Advisory
https://nextcloud.com/security/advisory/?id=NC-SA-2021-001Broken Link, Vendor Advisory
https://hackerone.com/reports/1018146Third Party Advisory
https://nextcloud.com/security/advisory/?id=NC-SA-2021-001Broken Link, Vendor Advisory

Timeline

Published: Jan 26, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-82945.4A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer CVE-2020-82957.5A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user.CVE-2020-82966.7Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured.CVE-2020-82974.3Nextcloud Deck before 1.0.2 suffers from an insecure direct object reference (IDOR) vulnerability that permits users with a duplicate user i CVE-2020-82989.8fs-path node module before 0.0.25 is vulnerable to command injection by way of user-supplied inputs via the `copy`, `copySync`, `remove`, an CVE-2020-82996.5Citrix ADC and Citrix/NetScaler Gateway 13.0 before 13.0-76.29, 12.1-61.18, 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238, and Citrix CVE-2020-83006.5Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from im CVE-2020-83155.5In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may r CVE-2020-83164.4A vulnerability was reported in Lenovo Vantage prior to version 10.2003.10.0 that could allow an authenticated user to read files on the sys CVE-2020-83177.8A DLL search path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that could allow an authenticated u CVE-2020-83187.8A privilege escalation vulnerability was reported in the LenovoSystemUpdatePlugin for Lenovo System Interface Foundation prior to version th CVE-2020-83197.8A privilege escalation vulnerability was reported in Lenovo System Interface Foundation prior to version 1.1.19.3 that could allow an authen