CVE-2023-48303

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, admins can change authentication details of user configured external storage. Nextcloud Server and Nextcloud Enterprise Server versions 25.0.11, 26.0.6, and 27.1.0 contain a patch for this issue. No known workarounds are available.

CVSS v3.0 2.7 LOW

2.7^/10

CVSS v3.0 : LOW

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2448-44rp-c7hh	Vendor Advisory
https://github.com/nextcloud/server/pull/39895	Issue Tracking Patch
https://hackerone.com/reports/2107934	Permissions Required

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:nextcloud:nextcloud_server:::::enterprise:::*
	cpe:2.3:a:nextcloud:nextcloud_server:::::-:::*
	cpe:2.3:a:nextcloud:nextcloud_server:::::-:::*
	cpe:2.3:a:nextcloud:nextcloud_server:::::enterprise:::*
	cpe:2.3:a:nextcloud:nextcloud_server:::::enterprise:::*
	cpe:2.3:a:nextcloud:nextcloud_server:::::-:::*

Information

Published : 2023-11-21 22:15

Updated : 2023-11-30 20:02

NVD link : CVE-2023-48303

Mitre link : CVE-2023-48303

JSON object : View

Products Affected

nextcloud

nextcloud_server

CWE

NVD-CWE-Other

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2448-44rp-c7hh", "name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2448-44rp-c7hh", "tags": ["Vendor Advisory"], "refsource": ""}, {"url": "https://github.com/nextcloud/server/pull/39895", "name": "https://github.com/nextcloud/server/pull/39895", "tags": ["Issue Tracking", "Patch"], "refsource": ""}, {"url": "https://hackerone.com/reports/2107934", "name": "https://hackerone.com/reports/2107934", "tags": ["Permissions Required"], "refsource": ""}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, admins can change authentication details of user configured external storage. Nextcloud Server and Nextcloud Enterprise Server versions 25.0.11, 26.0.6, and 27.1.0 contain a patch for this issue. No known workarounds are available."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2023-48303", "ASSIGNER": "security-advisories@github.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.2}}, "publishedDate": "2023-11-21T22:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "26.0.6", "versionStartIncluding": "26.0.0"}, {"cpe23Uri": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "26.0.6", "versionStartIncluding": "26.0.0"}, {"cpe23Uri": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "25.0.11", "versionStartIncluding": "25.0.0"}, {"cpe23Uri": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "25.0.11", "versionStartIncluding": "25.0.0"}, {"cpe23Uri": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "27.1.0", "versionStartIncluding": "27.0.0"}, {"cpe23Uri": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "27.1.0", "versionStartIncluding": "27.0.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2023-11-30T20:02Z"}