Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Nextcloud ausnutzen, um beliebigen Programmcode auszuführen oder Informationen offenzulegen.
Product
Nextcloud ist eine "on-premise" Plattform für Dateifreigabe und Zusammenarbeit.
Vulnerabilities 2
-
Critical 9.1CVE-2023-26482 Public exploit
Scope of workflow operations is not validated in nextcloud server
Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which are designed to be only available for administrators. Some workflows are designed to be RCE by invoking defin…
-
Low 3.5
Chat room membership disclosed via autocompletion in Nextcloud talk
Nextcloud talk is a video & audio conferencing app for Nextcloud. In affected versions the talk app does not properly filter access to a conversations member list. As a result an attacker could use this vulnerability to gain information about the members of a…
Revision history
-
#2
PoC für CVE-2023-26482 aufgenommen
-
#1
Initiale Fassung
References
-
Nextcloud Security Advisory vom 2023-04-02
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3m6r-479j-4chf
-
Nextcloud Security Advisory vom 2023-04-02
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h3c9-cmh8-7qpj
-
PoC CVE-2023-26482 vom 2026-02-09
https://github.com/ISabbiI/PoC---CVE-2023-26482-RCE-LAB-Nextcloud