Nextcloud DAV intermediate file listing info leak fix

Vulnerability Overview Vulnerability Title: fix(dav): do not list intermediate files #59780 Vulnerability Description: This vulnerability relates to the listing of intermediate files within the DAV (WebDAV) service. Specifically, intermediate files are incorrectly listed during the upload process, potentially leading to information disclosure or other security issues. Impact Scope Affected Versions: This vulnerability affects multiple versions of Nextcloud Server, including stable32, stable31, stable30, and stable29. Affected Components: Primarily impacts the DAV service module, specifically functionalities related to file uploads and directory listings. Remediation Fix Commit: - Author: susnux - Commit Date: April 21, 2023 - Commit Message: - - - Merge Date: April 22, 2023 - Merge Branch: - Merge Author: sorbaugh Fix Code: Fix Effect: - Resolves the issue where intermediate files were incorrectly listed in the DAV service, ensuring that intermediate files are not erroneously listed during the file upload process. - Resolves the issue where intermediate upload folders were incorrectly listed, ensuring that intermediate folders are not erroneously listed during the upload process. Additional Information Reviewers: - icewind1991 - provokateurin - ArtificialOwl - salmart-dev - leifybournes Labels: - bug - to review Milestone: - Nextcloud 34 Development Status: - Merging this pull request may close these issues. Participants: - susnux - provokateurin - icewind1991 - sorbaugh Summary This vulnerability involves the DAV service module of Nextcloud Server, primarily concerning the incorrect listing of intermediate files and folders during the upload process. The fix addresses this security issue by implementing specific code changes to prevent the erroneous listing of these intermediate files during uploads.

Goal Reached Thanks to every supporter — we hit 100%!

Nextcloud DAV intermediate file listing info leak fix

More from this source