What’s Vulnerable › Vulnerabilities

CVE-2020-8183

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-11-02 · updated 2026-06-17
• Weakness: CWE-256

Description

A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call.

Affected products

• Nextcloud Server: before 18.0.6; from 19.0.0 before 19.0.1 — fixed in 18.0.6, 19.0.1

How to fix

Upgrade to a fixed version: Nextcloud Server 18.0.6, 19.0.1. Check the vendor advisory for mitigations.

References

• https://hackerone.com/reports/885041
• https://nextcloud.com/security/advisory/?id=NC-SA-2020-026
• https://hackerone.com/reports/885041
• https://nextcloud.com/security/advisory/?id=NC-SA-2020-026

Get alerted when CVE-2020-8183 or the next vulnerability affects your stack