CVE-2023-28647

Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access to an unlocked device, they may enable the integration into the iOS Files app and bypass the Nextcloud pin/password protection and gain access to a users files. It is recommended that the Nextcloud iOS app is upgraded to 4.7.0. There are no known workarounds for this vulnerability.

CVSS v3 4.4 MEDIUM

4.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.3 / Impact : 3.7

Attack Vector PHYSICAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/nextcloud/ios/pull/2344	Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wjgg-2v4p-2gq6	Vendor Advisory
https://github.com/nextcloud/ios/pull/2344	Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wjgg-2v4p-2gq6	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:iphone_os:*:*

History

21 Nov 2024, 07:55

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~6.8~~	v2 : unknown v3 : 4.4
References	~~() https://github.com/nextcloud/ios/pull/2344 - Patch~~	() https://github.com/nextcloud/ios/pull/2344 - Patch
References	~~() https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wjgg-2v4p-2gq6 - Vendor Advisory~~	() https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wjgg-2v4p-2gq6 - Vendor Advisory

Information

Published : 2023-03-30 19:15

Updated : 2024-11-21 07:55

NVD link : CVE-2023-28647

Mitre link : CVE-2023-28647

CVE.ORG link : CVE-2023-28647

JSON object : View

Products Affected

nextcloud

nextcloud

CWE

CWE-281

Improper Preservation of Permissions

CWE-287

Improper Authentication

NVD-CWE-noinfo

{"id": "CVE-2023-28647", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 0.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}]}, "published": "2023-03-30T19:15:06.837", "references": [{"url": "https://github.com/nextcloud/ios/pull/2344", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wjgg-2v4p-2gq6", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nextcloud/ios/pull/2344", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wjgg-2v4p-2gq6", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-281"}, {"lang": "en", "value": "CWE-287"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access to an unlocked device, they may enable the integration into the iOS Files app and bypass the Nextcloud pin/password protection and gain access to a users files. It is recommended that the Nextcloud iOS app is upgraded to 4.7.0. There are no known workarounds for this vulnerability."}], "lastModified": "2024-11-21T07:55:44.097", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "8FF91531-0882-4755-98F8-D0C469119B9A", "versionEndExcluding": "4.7.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}