{"id":"CVE-2019-15623","aliases":["EUVD-2019-6580","GHSA-7vfj-8rgw-2c3q","openSUSE-SU-2020:0220-1","openSUSE-SU-2020:0229-1"],"status":"published","title":"Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain...","description":"Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01924,"percentile":0.8011,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-359"],"published":"2020-02-04T19:08:57Z","modified":"2026-10-24T10:30:52Z","affected":[{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"nextcloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.0.14-bp151.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"nextcloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.0.14-bp151.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"nextcloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.0.14-bp151.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"nextcloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.0.14-bp151.3.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"nextcloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.0.14-bp151.3.6.1"}]}],"bundled":6}],"products":[{"vendor":"hackerone","product":"nextcloud server"},{"vendor":"nextcloud","product":"nextcloud_server"},{"vendor":"opensuse","product":"backports_sle"},{"vendor":"suse","product":"package_hub"}],"references":[{"url":"https://hackerone.com/reports/508490","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://nextcloud.com/security/advisory/?id=NC-SA-2019-016","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","Vendor Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00019.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00022.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15623"},{"url":"https://github.com/advisories/GHSA-7vfj-8rgw-2c3q"},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4ZKAQ7AEGBUT5BPIHKS2AN3QK2XYBODP/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1162766","tags":["report"]},{"url":"https://bugzilla.suse.com/1162775","tags":["report"]},{"url":"https://bugzilla.suse.com/1162776","tags":["report"]},{"url":"https://bugzilla.suse.com/1162781","tags":["report"]},{"url":"https://bugzilla.suse.com/1162782","tags":["report"]},{"url":"https://bugzilla.suse.com/1162784","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8119","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YNXRESXAEC3O5ZYBXEVOSSEP4DH2EXOI/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-15623","description":"Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled.","status":"published","published":"2020-02-04T19:08:57Z","modified":"2024-08-05T00:56:20.906Z","cwes":["CWE-359"],"updated_at":"2026-11-02T14:20:21.059499Z"}],"euvd":[{"id":"EUVD-2019-6580","description":"Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled.","status":"published","published":"2020-02-04T19:08:57Z","modified":"2024-08-05T00:56:20Z","updated_at":"2026-11-03T02:40:35.584574Z"}],"ghsa":[{"id":"GHSA-7vfj-8rgw-2c3q","title":"Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain...","description":"Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled.","status":"published","published":"2022-05-24T17:07:57Z","modified":"2023-01-29T05:01:18Z","updated_at":"2026-11-02T14:44:46.934337Z"}],"nvd":[{"id":"CVE-2019-15623","description":"Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled.","status":"published","published":"2020-02-04T20:15:12.667Z","modified":"2026-06-17T02:20:46.083Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-359"],"updated_at":"2026-11-02T14:05:43.875329Z"}],"osv":[{"id":"CVE-2019-15623","description":"Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled.","status":"published","published":"2020-02-04T20:15:12.667Z","modified":"2026-10-24T10:30:52.723938656Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:11.361782Z"},{"id":"openSUSE-SU-2020:0220-1","title":"Security update for nextcloud","description":"This update for nextcloud fixes the following issues:\n\nNextcloud was updated to 15.0.14:\n\n- NC-SA-2020-002, CVE-2019-15613: workflow rules to depend their behaviour on the file extension when checking file mimetypes  (boo#1162766)\n- NC-SA-2019-016, CVE-2019-15623: Exposure of Private Information caused the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled (boo#1162775)\n- NC-SA-2019-015, CVE-2019-15624: Improper Input Validation allowed group admins to create users with IDs of system folders (boo#1162776)\n- NC-SA-2019-012, CVE-2020-8119: Improper authorization caused leaking of previews and files when a file-drop share link is opened via the gallery app (boo#1162781)\n- NC-SA-2019-014, CVE-2020-8118: An authenticated server-side request forgery allowed to detect local and remote services when adding a new subscription in the calendar application (boo#1162782)\n- NC-SA-2020-012, CVE-2019-15621: Improper permissions preservation causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link (boo#1162784)\n- To many changes.\n   For detail see: https://nextcloud.com/changelog/\n\nnextcloud was updated to 13.0.12:\n\n- Fix NC-SA-2020-001\n- To many changes.\n    For detail see: https://nextcloud.com/changelog/\n\n","status":"published","published":"2020-02-15T19:09:47Z","modified":"2026-02-04T04:00:09.192903Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:0229-1","title":"Security update for nextcloud","description":"This update for nextcloud fixes the following issues:\n\nNextcloud was updated to 15.0.14:\n\n- NC-SA-2020-002, CVE-2019-15613: workflow rules to depend their behaviour on the file extension when checking file mimetypes  (boo#1162766)\n- NC-SA-2019-016, CVE-2019-15623: Exposure of Private Information caused the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled (boo#1162775)\n- NC-SA-2019-015, CVE-2019-15624: Improper Input Validation allowed group admins to create users with IDs of system folders (boo#1162776)\n- NC-SA-2019-012, CVE-2020-8119: Improper authorization caused leaking of previews and files when a file-drop share link is opened via the gallery app (boo#1162781)\n- NC-SA-2019-014, CVE-2020-8118: An authenticated server-side request forgery allowed to detect local and remote services when adding a new subscription in the calendar application (boo#1162782)\n- NC-SA-2020-012, CVE-2019-15621: Improper permissions preservation causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link (boo#1162784)\n- To many changes.\n   For detail see: https://nextcloud.com/changelog/\n\nnextcloud was updated to 13.0.12:\n\n- Fix NC-SA-2020-001\n- To many changes.\n    For detail see: https://nextcloud.com/changelog/\n\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2020-02-17T12:31:04Z","modified":"2026-02-04T03:02:23.742999Z","updated_at":"2026-11-02T16:58:31.152112Z"}]}}