A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could potentially allow an attacker to obtain access to password protected shares. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. No vendor patch available.
Nextcloud
Session Fixation
Information Disclosure
Nextcloud Server
NVD
CVSS 3.0
3.1
EPSS
0.5%