CVE-2019-15613
A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file...
A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes.
- Record
CVE-2019-15613- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.0 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:P - Weakness
- CWE-20, CWE-345
- Updated
- 2026-11-02
CVE List No score
A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes.
- Record
CVE-2019-15613- Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2019-6570 No score
A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes.
- Record
EUVD-2019-6570- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rc6x-59rr-4g8r
A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file...
A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes.
- Record
GHSA-rc6x-59rr-4g8r- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-345
- Updated
- 2026-11-02
OSV
A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes.
- Record
CVE-2019-15613- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2020-0099 No score
Updated nextcloud packages fix security vulnerability
Updated nextcloud packages fix security vulnerability:
A bug in Nextcloud Server causes the workflow rules to depend their behavior on the file extension when checking file mimetypes (CVE-2019-15613).
The nextcloud package has been updated to version 15.0.14, fixing this issue and other bugs.
- Record
MGASA-2020-0099- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0220-1 No score
Security update for nextcloud
This update for nextcloud fixes the following issues:
Nextcloud was updated to 15.0.14:
- NC-SA-2020-002, CVE-2019-15613: workflow rules to depend their behaviour on the file extension when checking file mimetypes (boo#1162766)
- NC-SA-2019-016, CVE-2019-15623: Exposure of Private Information caused the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled (boo#1162775)
- NC-SA-2019-015, CVE-2019-15624: Improper Input Validation allowed group admins to create users with IDs of system folders (boo#1162776)
- NC-SA-2019-012, CVE-2020-8119: Improper authorization caused leaking of previews and files when a file-drop share link is opened via the gallery app (boo#1162781)
- NC-SA-2019-014, CVE-2020-8118: An authenticated server-side request forgery allowed to detect local and remote services when adding a new subscription in the calendar application (boo#1162782)
- NC-SA-2020-012, CVE-2019-15621: Improper permissions preservation causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link (boo#1162784)
- To many changes. For detail see: https://nextcloud.com/changelog/
nextcloud was updated to 13.0.12:
- Fix NC-SA-2020-001
- To many changes. For detail see: https://nextcloud.com/changelog/
- Record
openSUSE-SU-2020:0220-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0229-1 No score
Security update for nextcloud
This update for nextcloud fixes the following issues:
Nextcloud was updated to 15.0.14:
- NC-SA-2020-002, CVE-2019-15613: workflow rules to depend their behaviour on the file extension when checking file mimetypes (boo#1162766)
- NC-SA-2019-016, CVE-2019-15623: Exposure of Private Information caused the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled (boo#1162775)
- NC-SA-2019-015, CVE-2019-15624: Improper Input Validation allowed group admins to create users with IDs of system folders (boo#1162776)
- NC-SA-2019-012, CVE-2020-8119: Improper authorization caused leaking of previews and files when a file-drop share link is opened via the gallery app (boo#1162781)
- NC-SA-2019-014, CVE-2020-8118: An authenticated server-side request forgery allowed to detect local and remote services when adding a new subscription in the calendar application (boo#1162782)
- NC-SA-2020-012, CVE-2019-15621: Improper permissions preservation causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link (boo#1162784)
- To many changes. For detail see: https://nextcloud.com/changelog/
nextcloud was updated to 13.0.12:
- Fix NC-SA-2020-001
- To many changes. For detail see: https://nextcloud.com/changelog/
This update was imported from the openSUSE:Leap:15.1:Update update project.
- Record
openSUSE-SU-2020:0229-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nextcloudMageia:7 |
before 15.0.14-1.mga7 | 15.0.14-1.mga7 |
nextcloudSUSE:Package Hub 12 |
before 15.0.14-bp151.3.3.1 | 15.0.14-bp151.3.3.1 |
nextcloudSUSE:Package Hub 15 |
before 15.0.14-bp151.3.3.1 | 15.0.14-bp151.3.3.1 |
nextcloudSUSE:Package Hub 15 SP1 |
before 15.0.14-bp151.3.3.1 | 15.0.14-bp151.3.3.1 |
nextcloudopenSUSE:Leap 15.1 |
before 15.0.14-bp151.3.3.1 | 15.0.14-bp151.3.3.1 |
nextcloudSUSE:Package Hub 15 SP1 |
before 15.0.14-bp151.3.6.1 | 15.0.14-bp151.3.6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-15613 is a high vulnerability (CVSS 8.0) in Hackerone Nextcloud Server, published February 4, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.13%, the 66th percentile. Fixed in nextcloud 15.0.14-1.mga7.
References
hackerone.com/reports/697959
nextcloud.com/security/advisory?id=NC-SA-2020-002
lists.opensuse.org/opensuse-security-announce/2020-02/msg00019.html
nvd.nist.gov/vuln/detail/CVE-2019-15613
github.com/advisories/GHSA-rc6x-59rr-4g8r
Show 17 moreShow less
advisories.mageia.org/MGASA-2020-0099.html
bugs.mageia.org/show_bug.cgi?id=26225
bugzilla.suse.com/1162766
suse.com/security/cve/CVE-2019-15613