CVE-2023-25817

Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their permissions to delete files they were not supposed to deletable but only viewed or downloaded. This issue has been addressed andit is recommended that the Nextcloud Server is upgraded to 24.0.9. There are no known workarounds for this vulnerability.

CVSS v3 3.5 LOW

3.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8v5c-f752-fgpv	Patch Vendor Advisory
https://github.com/nextcloud/server/pull/33941	Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8v5c-f752-fgpv	Patch Vendor Advisory
https://github.com/nextcloud/server/pull/33941	Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:50

Type	Values Removed	Values Added
References	~~() https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8v5c-f752-fgpv - Patch, Vendor Advisory~~	() https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8v5c-f752-fgpv - Patch, Vendor Advisory
References	~~() https://github.com/nextcloud/server/pull/33941 - Patch~~	() https://github.com/nextcloud/server/pull/33941 - Patch
CVSS	v2 : ~~unknown~~ v3 : ~~8.1~~	v2 : unknown v3 : 3.5

Information

Published : 2023-03-27 21:15

Updated : 2024-11-21 07:50

NVD link : CVE-2023-25817

Mitre link : CVE-2023-25817

CVE.ORG link : CVE-2023-25817

JSON object : View

Products Affected

nextcloud

nextcloud_server

CWE

CWE-281

Improper Preservation of Permissions

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2023-25817", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2023-03-27T21:15:11.127", "references": [{"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8v5c-f752-fgpv", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nextcloud/server/pull/33941", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8v5c-f752-fgpv", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/nextcloud/server/pull/33941", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-281"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their permissions to delete files they were not supposed to deletable but only viewed or downloaded. This issue has been addressed andit is recommended that the Nextcloud Server is upgraded to 24.0.9. There are no known workarounds for this vulnerability."}], "lastModified": "2024-11-21T07:50:15.600", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B68C1CBB-9670-4B21-9705-35C0080DB7A2", "versionEndExcluding": "24.0.9", "versionStartIncluding": "24.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}