CVE-2016-9463
Quick assessment
Affected
n/a Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ownCloud是德国ownCloud公司的一套免费且开源的个人云存储解决方案。Nextcloud是一套开源的自托管文件同步和共享的通信应用平台。ownCloud Server和Nextcloud Server都是其中的一个服务器版。 Nextcloud Server和ownCloud Server中存在安全漏洞。攻击者可利用该漏洞获取账户的访问权限。以下产品和版本受到影响：Nextcloud Server 9.0.54之前的版本，10.0.1之前的版本；ownCloud Server 9.0.6之前的版
Possible ATT&CK Techniques 1 AI
T1076
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2016-9463
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authentication Bypass. Nextcloud/ownCloud include an optional and not by default enabled SMB authentication component that allows authenticating users against an SMB server. This backend is implemented in a way that tries to connect to a SMB server and if that succeeded consider the user logged-in. The backend did not properly take into account SMB servers that have any kind of anonymous auth configured. This is the default on SMB servers nowadays and allows an unauthenticated attacker to gain access to an account without valid credentials. Note: The SMB backend is disabled by default and requires manual configuration in the Nextcloud/ownCloud config file. If you have not configured the SMB backend then you're not affected by this vulnerability.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
认证算法的不正确实现
Source: CVE Program / CVE List V5
Vulnerability Title
Nextcloud Server和ownCloud Server 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ownCloud是德国ownCloud公司的一套免费且开源的个人云存储解决方案。Nextcloud是一套开源的自托管文件同步和共享的通信应用平台。ownCloud Server和Nextcloud Server都是其中的一个服务器版。 Nextcloud Server和ownCloud Server中存在安全漏洞。攻击者可利用该漏洞获取账户的访问权限。以下产品和版本受到影响：Nextcloud Server 9.0.54之前的版本，10.0.1之前的版本；ownCloud Server 9.0.6之前的版
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 | Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 | - |
|
II. Public POCs for CVE-2016-9463
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2016-9463
请登录查看更多情报信息。
Patches & Fixes for CVE-2016-9463 (5)
Other References for CVE-2016-9463 (4)
-
https://owncloud.org/security/advisory/?id=oc-sa-2016-017 x_refsource_MISC
-
https://hackerone.com/reports/148151 x_refsource_MISC
-
https://nextcloud.com/security/advisory/?id=nc-sa-2016-006 x_refsource_MISC
Same Patch Batch · n/a · 2017-03-28 · 36 CVEs total
| CVE-2016-9468 | Nextcloud Server和ownCloud Server 安全漏洞 | |
| CVE-2016-9459 | Nextcloud Server和ownCloud Server 跨站脚本漏洞 | |
| CVE-2016-9460 | Nextcloud Server和ownCloud Server 安全漏洞 | |
| CVE-2016-9461 | Nextcloud Server和ownCloud Server 安全漏洞 | |
| CVE-2016-9462 | ownCloud Server和Nextcloud Server 安全漏洞 | |
| CVE-2016-9464 | Nextcloud Server 安全漏洞 | |
| CVE-2016-9465 | Nextcloud Server和ownCloud Server 跨站脚本漏洞 | |
| CVE-2016-9466 | ownCloud Server和Nextcloud Server 跨站脚本漏洞 | |
| CVE-2016-9467 | Nextcloud Server和ownCloud Server 安全漏洞 | |
| CVE-2016-9457 | Revive Adserver 跨站脚本漏洞 | |
| CVE-2016-9469 | GitLab 安全漏洞 | |
| CVE-2016-9470 | Revive Adserver 安全漏洞 | |
| CVE-2016-9471 | Revive Adserver 安全漏洞 | |
| CVE-2016-9472 | Revive Adserver 跨站脚本漏洞 | |
| CVE-2016-9473 | Brave Browser iOS和Brave Browser Android 安全漏洞 | |
| CVE-2017-0881 | Zulip group chat application server 安全漏洞 | |
| CVE-2017-0882 | GitLab 安全漏洞 | |
| CVE-2017-6964 | Debian和Ubuntu eject安装包dmcrypt-get-device安全漏洞 | |
| CVE-2016-9126 | Revive Adserver 跨站脚本漏洞 | |
| CVE-2016-10152 | Hesiod 安全漏洞 |
Showing top 20 of 36 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: n/a
-
CVE-2026-105708
imgproxy SVG svg.go sanitizeElement cross site scripting -
CVE-2026-105707
uptrace user_handler.go Login information exposure -
CVE-2026-105572
PickMall Lilishop Buyer Invoice List receipt authorization -
CVE-2026-105571
PickMall Lilishop Mobile Binding bindMobile improper authori -
CVE-2026-77178
Oracle VM VirtualBox 堆外写漏洞
Same weakness: CWE-303
-
CVE-2026-97720
Apache Impala: Impala Executor Webserver Auth Bypass -
CVE-2026-92873
Pgpool-II认证算法缺陷致未授权提升看门狗节点 -
CVE-2026-101878
Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass v -
CVE-2026-93394
libmongoc SCRAM client nonce-validation bypass -
CVE-2026-15688
Password Authentication Bypass Vulnerability in GX Works3 an
V. Comments for CVE-2016-9463
No comments yet