{"id":"CVE-2016-9468","aliases":["EUVD-2016-10274","GHSA-q5x2-7c2j-3rwq"],"status":"published","title":"Nextcloud Server before 9.0.54 and 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2 suffer from...","description":"Nextcloud Server before 9.0.54 and 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a potential misrepresentation of information.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02077,"percentile":0.81615,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284","CWE-451"],"published":"2017-03-28T02:46:00Z","modified":"2026-10-24T10:49:25Z","products":[{"vendor":"nextcloud","product":"nextcloud_server"},{"vendor":"owncloud","product":"owncloud"}],"references":[{"url":"https://owncloud.org/security/advisory/?id=oc-sa-2016-021","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://github.com/nextcloud/server/commit/a4cfb3ddc1f4cdb585e05c0e9b2f8e52a0e2ee3e","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/nextcloud/server/commit/7350e13113c8ed484727a5c25331ec11d4d59f5f","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/owncloud/core/commit/96b8afe48570bc70088ccd8f897e9d71997d336e","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://hackerone.com/reports/149798","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://github.com/owncloud/core/commit/bcc6c39ad8c22a00323a114e9c1a0a834983fb35","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://nextcloud.com/security/advisory/?id=nc-sa-2016-011","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9468"},{"url":"https://github.com/advisories/GHSA-q5x2-7c2j-3rwq"}],"sources":{"cve":[{"id":"CVE-2016-9468","description":"Nextcloud Server before 9.0.54 and 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a potential misrepresentation of information.","status":"published","published":"2017-03-28T02:46:00Z","modified":"2024-08-06T02:50:38.587Z","cwes":["CWE-451"],"updated_at":"2026-11-02T14:33:31.764001Z"}],"euvd":[{"id":"EUVD-2016-10274","description":"Nextcloud Server before 9.0.54 and 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a potential misrepresentation of information.","status":"published","published":"2017-03-28T02:46:00Z","modified":"2024-08-06T02:50:38Z","updated_at":"2026-11-03T02:22:27.235814Z"}],"ghsa":[{"id":"GHSA-q5x2-7c2j-3rwq","title":"Nextcloud Server before 9.0.54 and 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2 suffer from...","description":"Nextcloud Server before 9.0.54 and 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a potential misrepresentation of information.","status":"published","published":"2022-05-13T01:38:32Z","modified":"2025-04-20T03:36:00Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-284","CWE-451"],"updated_at":"2026-11-02T15:01:43.480751Z"}],"nvd":[{"id":"CVE-2016-9468","description":"Nextcloud Server before 9.0.54 and 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a potential misrepresentation of information.","status":"published","published":"2017-03-28T02:59:01.2Z","modified":"2026-06-17T00:56:07.787Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-451","CWE-284"],"updated_at":"2026-11-02T14:03:37.238712Z"}],"osv":[{"id":"CVE-2016-9468","description":"Nextcloud Server before 9.0.54 and 10.0.1 \u0026 ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a potential misrepresentation of information.","status":"published","published":"2017-03-28T02:59:01.2Z","modified":"2026-10-24T10:49:25.32166974Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:03.472693Z"}]}}