CVE-2019-15624: 
Linux openSUSE vulnerability analysis and mitigation

Improper Input Validation vulnerability (CVE-2019-15624) was discovered in Nextcloud Server 15.0.7, allowing group administrators to create users with IDs of system folders. The vulnerability was disclosed and addressed in February 2020 (NVD, CVE).

The vulnerability is classified as an Improper Input Validation (CWE-20) issue. It has a CVSS v3.1 Base Score of 4.9 (Medium), with an Impact Score of 3.6 and Exploitability Score of 1.2. The attack vector is Network-based, requires High privileges, and no user interaction, with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N (AttackerKB).

The vulnerability affects the integrity of the system by allowing group administrators to potentially interfere with system operations through the creation of users with system folder IDs. There is no impact on confidentiality or availability (AttackerKB).

The vulnerability requires high privileges (group admin access) to exploit, making it less accessible to general attackers. The attack complexity is rated as Low, indicating that once an attacker has the required privileges, the exploitation is straightforward (AttackerKB).

The vulnerability was patched in Nextcloud version 15.0.14. Users are advised to upgrade to this version or later. The fix was distributed through various channels including SUSE Package Hub for SUSE Linux Enterprise 12 and openSUSE Backports (OpenSUSE Security).