CVE-2019-15623

Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain...

5.3 MediumFix available

Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

1.92%Up 0.9 points since Apr 14, 2021

What each source reports

NVD Score used 5.3

Record: CVE-2019-15623
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-359
Updated: 2026-11-02

CVE List No score

Record: CVE-2019-15623
Weakness: CWE-359
Updated: 2026-11-02

EUVDEUVD-2019-6580 No score

Record: EUVD-2019-6580
Updated: 2026-11-03

GitHub AdvisoriesGHSA-7vfj-8rgw-2c3q No score

Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain...

Record: GHSA-7vfj-8rgw-2c3q
Updated: 2026-11-02

OSV 5.3

Record: CVE-2019-15623
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

OSVopenSUSE-SU-2020:0220-1 No score

Security update for nextcloud

This update for nextcloud fixes the following issues:

Nextcloud was updated to 15.0.14:

NC-SA-2020-002, CVE-2019-15613: workflow rules to depend their behaviour on the file extension when checking file mimetypes (boo#1162766)
NC-SA-2019-016, CVE-2019-15623: Exposure of Private Information caused the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled (boo#1162775)
NC-SA-2019-015, CVE-2019-15624: Improper Input Validation allowed group admins to create users with IDs of system folders (boo#1162776)
NC-SA-2019-012, CVE-2020-8119: Improper authorization caused leaking of previews and files when a file-drop share link is opened via the gallery app (boo#1162781)
NC-SA-2019-014, CVE-2020-8118: An authenticated server-side request forgery allowed to detect local and remote services when adding a new subscription in the calendar application (boo#1162782)
NC-SA-2020-012, CVE-2019-15621: Improper permissions preservation causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link (boo#1162784)
To many changes. For detail see: https://nextcloud.com/changelog/

nextcloud was updated to 13.0.12:

Fix NC-SA-2020-001
To many changes. For detail see: https://nextcloud.com/changelog/

Record: openSUSE-SU-2020:0220-1
Updated: 2026-11-02

OSVopenSUSE-SU-2020:0229-1 No score

Security update for nextcloud

This update for nextcloud fixes the following issues:

Nextcloud was updated to 15.0.14:

NC-SA-2020-002, CVE-2019-15613: workflow rules to depend their behaviour on the file extension when checking file mimetypes (boo#1162766)
NC-SA-2019-016, CVE-2019-15623: Exposure of Private Information caused the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled (boo#1162775)
NC-SA-2019-015, CVE-2019-15624: Improper Input Validation allowed group admins to create users with IDs of system folders (boo#1162776)
NC-SA-2019-012, CVE-2020-8119: Improper authorization caused leaking of previews and files when a file-drop share link is opened via the gallery app (boo#1162781)
NC-SA-2019-014, CVE-2020-8118: An authenticated server-side request forgery allowed to detect local and remote services when adding a new subscription in the calendar application (boo#1162782)
NC-SA-2020-012, CVE-2019-15621: Improper permissions preservation causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link (boo#1162784)
To many changes. For detail see: https://nextcloud.com/changelog/

nextcloud was updated to 13.0.12:

Fix NC-SA-2020-001
To many changes. For detail see: https://nextcloud.com/changelog/

This update was imported from the openSUSE:Leap:15.1:Update update project.

Record: openSUSE-SU-2020:0229-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`nextcloud` SUSE:Package Hub 12	before 15.0.14-bp151.3.3.1	15.0.14-bp151.3.3.1
`nextcloud` SUSE:Package Hub 15	before 15.0.14-bp151.3.3.1	15.0.14-bp151.3.3.1
`nextcloud` SUSE:Package Hub 15 SP1	before 15.0.14-bp151.3.3.1	15.0.14-bp151.3.3.1
`nextcloud` openSUSE:Leap 15.1	before 15.0.14-bp151.3.3.1	15.0.14-bp151.3.3.1
`nextcloud` SUSE:Package Hub 15 SP1	before 15.0.14-bp151.3.6.1	15.0.14-bp151.3.6.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, products	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-15623 is a medium vulnerability (CVSS 5.3) in Hackerone Nextcloud Server, published February 4, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.92%, the 80th percentile. Fixed in nextcloud 15.0.14-bp151.3.3.1.

References

Show 14 moreShow less