PT-2023-19315 · Owncloud · Owncloud Android App

Tony Torralba · Publicado 2023-02-13 · Atualizado 2023-02-26 · CVE-2023-23948

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Média

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ownCloud Android app version 2.21.1 ownCloud Android app versions 3.0 and earlier

Description The ownCloud Android app is affected by a SQL injection issue in FileContentProvider.kt, which can lead to information disclosure. Two databases, filelist and owncloud database, are impacted. Although the filelist database was deprecated in version 3.0, injections affecting owncloud database remain relevant as of version 3.0.

Recommendations For version 2.21.1, consider updating to a version where the SQL injection issue in FileContentProvider.kt is fixed. For versions 3.0 and earlier, restrict access to the owncloud database to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider disabling the FileContentProvider.kt function until a patch is available.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-23948

Produtos afetados

Owncloud Android App

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23948.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2022-059_GHSL-2022-060_Owncloud_Android_app · Exploit
• https://t.me/cvenotify/44274 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-23948 · Aviso do Fabricante
• https://t.me/cybersecuritytechnologies/7828 · Publicação no Telegram
• https://t.me/thebugbountyhunter/7056 · Publicação no Telegram
• https://t.me/cibsecurity/58013 · Publicação no Telegram
• https://t.me/cvenotify/44253 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-23948 · Nota de Segurança