Nextcloud · Report #1337422
Folder architecture and Filesizes of private file drop shares can be getten
Validstatus
mediumseverity
18upvotes
9 Apr 2022disclosed
How it was found
Steps To Reproduce:
- Create a new Folder "TestABC"
- Share a password protected link of this folder
- Create a file "README.md" and a file "README.md" in the Subfolder "Subfolder".
==> curl -H "OCS-APIREQUEST: true" "http://localhost/ocs/v2.php/apps/text/public/workspace?shareToken=ABCDE12345"
==> curl -H "OCS-APIREQUEST: true" "http://localhost/ocs/v2.php/apps/text/public/workspace?shareToken=ABCDE12345&folder=subfolder"
Impact
Folder architecture and Filesizes of private file drop shares can be getten