CVE-2016-9459 describes a log pollution vulnerability in Nextcloud Server before 9.0.52 and ownCloud Server before 9.0.4. This flaw allows for a potential local Cross-Site Scripting (XSS) attack. The vulnerability arises when the admin screen's download log functionality, delivering JSON-formatted logs, is opened by Firefox on Windows, which can interpret the log as an HTML document, executing injected data. Rated Medium severity with a CVSS score of 6.1, the attack vector is network-based with low complexity, requiring user interaction. A successful exploit could lead to limited confidentiality and integrity impacts. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The vulnerability has received minimal community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 9.0.52CPE matchmatch criteria | cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:* | ||
< 9.0.4CPE matchmatch criteria | cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.