MEDIUM
CVE-2016-9462
CWE-275Published: March 28, 2017· Updated: Jun 17, 2026
4.3
CVSS v3.1
Official Description
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a share. Thus a user with read-only access was able to restore old versions.
Technical Analysis
CVE-2016-9462 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CVSS v3.1 Vector Breakdown
Exploitability
Attack VectorNetwork
Attack ComplexityLow
Privileges Req.Low
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityNone
IntegrityLow
AvailabilityNone
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected Vendors & Products
Exploit & PoC Resources
NO KNOWN EXPLOITNo public exploit confirmed at this time
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.
Official Patches & Advisories
All References (18)
→
http://www.securityfocus.com/bid/97285Third Party Advisory · VDB Entry
→
https://github.com/nextcloud/server/commit/1208953ba1d4d55a18a639846bbcdd66a2d5bc5eIssue Tracking · Patch · Third Party Advisory
→
https://github.com/owncloud/core/commit/23383080731d092e079986464a8c4c9ffcb79f4cIssue Tracking · Patch · Third Party Advisory
→
https://github.com/owncloud/core/commit/3b056fa68ce502ceb0db9b446dab3b9e7b10dd13Issue Tracking · Patch · Third Party Advisory
→
https://github.com/owncloud/core/commit/c93eca49c32428ece03dd67042772d5fa62c8d6eIssue Tracking · Patch · Third Party Advisory
→
https://github.com/owncloud/core/commit/d31720b6f1e8c8dfeb5e8805ab35ad7c8000b2f1Issue Tracking · Patch · Third Party Advisory
→
https://hackerone.com/reports/146067Exploit · Third Party Advisory
→
https://nextcloud.com/security/advisory/?id=nc-sa-2016-005Patch · Vendor Advisory
→
https://owncloud.org/security/advisory/?id=oc-sa-2016-015Patch · Vendor Advisory
→
http://www.securityfocus.com/bid/97285Third Party Advisory · VDB Entry
→
https://github.com/nextcloud/server/commit/1208953ba1d4d55a18a639846bbcdd66a2d5bc5eIssue Tracking · Patch · Third Party Advisory
→
https://github.com/owncloud/core/commit/23383080731d092e079986464a8c4c9ffcb79f4cIssue Tracking · Patch · Third Party Advisory
→
https://github.com/owncloud/core/commit/3b056fa68ce502ceb0db9b446dab3b9e7b10dd13Issue Tracking · Patch · Third Party Advisory
→
https://github.com/owncloud/core/commit/c93eca49c32428ece03dd67042772d5fa62c8d6eIssue Tracking · Patch · Third Party Advisory
→
https://github.com/owncloud/core/commit/d31720b6f1e8c8dfeb5e8805ab35ad7c8000b2f1Issue Tracking · Patch · Third Party Advisory
Quick Facts
CVE IDCVE-2016-9462
CVSS Score4.3 / 10
SeverityMEDIUM
WeaknessCWE-275
CISA KEVNo
Affected2 vendor(s)
PublishedMar 28, 2017
Related CVEs (CWE-275)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2016-9462 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.