Skip to content
OpenAdvisories
High WID-SEC-2023-2973 8 CVEs

Nextcloud: Mehrere Schwachstellen

Published Nov 20, 2023 · Updated Nov 20, 2023 · de-DE

Vendor: Nextcloud Product: Nextcloud Product: Nextcloud < Mail 2.2.8 Product: Nextcloud < Mail 3.3.0 Product: Nextcloud < Server 25.0.11 Product: Nextcloud < Server 25.0.13 Product: Nextcloud < Server 26.0.6 Product: Nextcloud < Server 26.0.8 Product: Nextcloud < Server 27.1.0 Product: Nextcloud < Server 27.1.3 Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Nextcloud ausnutzen, um einen Denial of Service Angriff durchzuführen, um einen Denial of Service Zustand herbeizuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen oder Sicherheitsvorkehrungen zu umgehen.

Product

Nextcloud ist eine "on-premise" Plattform für Dateifreigabe und Zusammenarbeit.

Vulnerabilities 8

  • High 8.5
    CVE-2023-48239

    Nextcloud Server users can make external storage mount points inaccessible for other users

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and starting in version 20.0.0 and prior to versions 20.0.14.16, 21.0.9.13, 2…

    Nextcloud security-advisories
  • Medium 5.0
    CVE-2023-48306

    Nextcloud Server DNS pin middleware can be tricked into DNS rebinding allowing SSRF

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in version 22.0.0 and prior to versions 22.2.10.16, 23.0.12.11, …

    Nextcloud security-advisories
  • Medium 4.3
    CVE-2023-48304

    Nextcloud Server vulnerable to attacker enabling/disabling birthday calendar for any user

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in version 22.0.0 and prior to versions 22.2.10.16, 23.0.12.11, …

    Nextcloud security-advisories
  • Medium 4.2
    CVE-2023-48305

    Nextcloud Server user_ldap app logs user passwords in the log file on level debug

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, when the log level was set to debug, the use…

    Nextcloud security-advisories
  • Low 3.5
    CVE-2023-48301

    Nextcloud Server HTML injection in search UI when selecting a circle with HTML in the display name

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, an attacker could insert links into circles …

    Nextcloud security-advisories
  • Low 3.5
    CVE-2023-48302

    Nextcloud Server vulnerable to Self XSS when pasting HTML into Text app with Ctrl+Shift+V

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, when a user is tricked into copy pasting HTM…

    Nextcloud security-advisories
  • Low 3.5
    CVE-2023-48307

    Nextcloud Mail app vulnerable to Server-Side Request Forgery

    Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Starting in version 1.13.0 and prior to version 2.2.8 and 3.3.0, an attacker can use an unprotected endpoint in the Mail app to perform a SSRF attack. Nextcloud Mail app versio…

    Nextcloud security-advisories
  • Low 2.4
    CVE-2023-48303

    Nextcloud Server admins can change authentication details of user configured external storage

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, admins can change authentication details of …

    Nextcloud security-advisories

Revision history

  1. #1

    Initiale Fassung

References