ownCloud: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 3

• Critical 10.0
  CVE-2023-49103 Exploited Public exploit Scanner template EPSS 78%

  An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relie…

  Nov 21, 2023

  KEV Nov 30, 2023
• Critical 9.8
  CVE-2023-49105 Exploited Public exploit EPSS 43%

  An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file wi…

  Nov 21, 2023

  KEV Aug 27, 2026
• High 8.7
  CVE-2023-49104

  An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled. An attacker is able…

  Nov 21, 2023

Revision history

1. 2026-08-27 #3

   CVE-2023-49105 wird ausgenutzt

2. 2023-11-28 #2

   Aktive Ausnutzung gemeldet

3. 2023-11-21 #1

   Initiale Fassung

References

• GitHub Advisory Database vom 2023-11-21
  https://github.com/advisories/GHSA-7f2q-q825-57p8
• GitHub Advisory Database vom 2023-11-21
  https://github.com/advisories/GHSA-phfx-x4q3-w99v
• GitHub Advisory Database vom 2023-11-21
  https://github.com/advisories/GHSA-585g-f852-v6p4
• ownCloud Security Advisory vom 2023-11-21
  https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/
• ownCloud Security Advisory vom 2023-11-21
  https://owncloud.com/security-advisories/subdomain-validation-bypass/
• ownCloud Security Advisory vom 2023-11-21
  https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/
• Greynoise Blog vom 2023-11-28
  https://www.greynoise.io/blog/cve-2023-49103-owncloud-critical-vulnerability-quickly-exploited-in-the-wild
• CISA KEV CVE-2023-49105 vom 2026-08-27
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49105