Skip to content
OpenAdvisories
Medium WID-SEC-2023-3166 4 CVEs

Nextcloud: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen

Published Dec 17, 2023 · Updated Dec 17, 2023 · de-DE

Vendor: Nextcloud Product: Nextcloud Product: Nextcloud < 26.0.9 Product: Nextcloud < 27.1.4 Product: Nextcloud Calendar < 4.5.3 Product: Nextcloud Enterprise < 23.0.12.13 Product: Nextcloud Enterprise < 24.0.12.9 Product: Nextcloud Enterprise < 25.0.13.4 Product: Nextcloud Enterprise < 26.0.9 Product: Nextcloud Enterprise < 27.1.4 Product: Nextcloud Files iOS < 4.9.2 Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Nextcloud, der Calendar App und dem Files iOS Paket ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

Product

Nextcloud ist eine "on-premise" Plattform für Dateifreigabe und Zusammenarbeit.

Vulnerabilities 4

  • Medium 5.4
    CVE-2023-49791

    Workflows do not require password confirmation on API level

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a…

    Nextcloud security-advisories
  • Medium 5.3
    CVE-2023-49792 Public exploit

    Bruteforce protection can be bypassed with misconfigured proxy

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a…

    Nextcloud security-advisories
  • Medium 4.3
    CVE-2023-49790

    App PIN code can be bypassed in Nextcloud Files iOS

    The Nextcloud iOS Files app allows users of iOS to interact with Nextcloud, a self-hosted productivity platform. Prior to version 4.9.2, the application can be used without providing the 4 digit PIN code. Nextcloud iOS Files app should be upgraded to 4.9.2 to…

    Nextcloud security-advisories
  • Low 3.5
    CVE-2023-48308

    Calendar app returns full stacktrace when an error happens while editing appointment

    Nextcloud/Cloud is a calendar app for Nextcloud. An attacker can gain access to stacktrace and internal paths of the server when generating an exception while editing a calendar appointment. It is recommended that the Nextcloud Calendar app is upgraded to 4.5…

    Nextcloud security-advisories

Revision history

  1. #1

    Initiale Fassung

References