Description (CNA)
Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the public key to decrypt them later on.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / Nextcloud Server | affected Fixed in 20.0.0 |
CWE
CWE-522
References
- https://hackerone.com/reports/743505
- https://nextcloud.com/security/advisory/?id=NC-SA-2020-040
- http://seclists.org/fulldisclosure/2020/Dec/54
ADP enrichment
No English description supplied.