Overview :
A missing check in Nextcloud Server 14.0.3 could give recipient the possibility to extend the expiration date of a share they received.
Affected Product(s) :
  • Nextcloud Server 14.0.3
Vulnerability Details :
CVE ID : CVE-2020-8122
Risk level:Low
CVSS v3 Base Score:4.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
CWE:Improper Access Control – Generic (CWE-284)

Solution :

It is recommended that all instances are upgraded to Nextcloud 15.0.0, Nextcloud 14.0.4, Nextcloud 13.0.8 or 12.0.13.