Vulnerability in Nextcloud Server
CVE-2023-35928
Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 19.0.0 until 19.0.13.9, 20.0.0 until 20.0.14.14, 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, a user could use this functionality to get access to the login credentials of another user and take over their account. This issue has been patched in Nextcloud Server versions 25.0.7 and 26.0.2 and NextCloud Enterprise Server versions 19.0.13.9, 20.0.14.14, 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2, 25.0.7, and 26.0.2. Three workarounds are available. Disable app files_external. Change config setting "Allow users to mount external storage" to disabled in "Administration" > "External storage" settings `…/index.php/settings/admin/externalstorages`. Change config setting to disallow users to create external storages in "Administration" > "External storage" settings `…/index.php/settings/admin/externalstorages` with the types FTP, Nextcloud, SFTP, and/or WebDAV.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.010 (61.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 62nd percentile — 61.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
- Nextcloud Server
- Nextcloud Security-Advisories — versions Nextcloud Enterprise Server >= 19.0.0, < 19.0.13.9, Nextcloud Enterprise Server >= 20.0.0.0, < 20.0.14.14, Nextcloud Enterprise Server >= 21.0.0.0, < 21.0.9.12
Weakness classification (CWE)
References
- github.com/nextcloud/security-advisories/security/advisories/GHSA-637g-xp2c-qh5h (Vendor Advisory)
- github.com/nextcloud/server/pull/38265 (Issue Tracking)
- hackerone.com/reports/1978882 (Third Party Advisory)
Frequently asked questions
- What is CVE-2023-35928?
- CVE-2023-35928 is a high-severity vulnerability in Nextcloud Server, classified under Improper Handling of Insufficient Privileges. CVSS score: 8.4/10. Published 2023-06-23.
- How severe is CVE-2023-35928?
- High severity. CVSS v3 base score is 8.4 out of 10.