CVE-2018-16463

3.1 lowEPSS 0.5%

A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could potentially allow an attacker to obtain access to password protected shares.

Severity

CVSS 3.0

3.1 low

CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
CWE: CWE-384
Published: 2018-10-30
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

nextcloud:nextcloud_server

References

https://hackerone.com/reports/237184
https://nextcloud.com/security/advisory/?id=NC-SA-2018-013
https://hackerone.com/reports/237184
https://nextcloud.com/security/advisory/?id=NC-SA-2018-013

Check your stack JSON