Description (CNA)
A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL config into a fixed directory.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / Desktop Client | affected Fixed in 2.6.5 |
CWE
CWE-94
References
- https://hackerone.com/reports/622170
- https://nextcloud.com/security/advisory/?id=NC-SA-2020-030
- https://security.gentoo.org/glsa/202009-09
ADP enrichment
No English description supplied.