PT-2023-19940 · Nextcloud · Nextcloud Office

Juliushaertl · Publicado 2023-02-08 · Atualizado 2023-02-16 · CVE-2023-25150

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Média

Vetor base

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Office versions prior to 7.0.2 Nextcloud Office versions prior to 6.3.2 Nextcloud Office versions prior to 5.0.10 Nextcloud Office versions prior to 4.2.9 Nextcloud Office versions prior to 3.8.7

Description The Collabora integration in Nextcloud Office can be tricked into providing access to any file without proper permission validation, allowing any user with access to Collabora to obtain the content of other users' files.

Recommendations Update the Nextcloud Office App (Collabora Integration) to version 7.0.2 for Nextcloud 25. Update the Nextcloud Office App (Collabora Integration) to version 6.3.2 for Nextcloud 24. Update the Nextcloud Office App (Collabora Integration) to version 5.0.10 for Nextcloud 23. Update the Nextcloud Office App (Collabora Integration) to version 4.2.9 for Nextcloud 21-22. Update the Nextcloud Office App (Collabora Integration) to version 3.8.7 for Nextcloud 15-20.

Exploit

Correção

Incorrect Permission

Improper Access Control

Enumeração de Fraquezas

CWE-732

CWE-284

Identificadores relacionados

CVE-2023-25150

GHSA-64XC-R58V-53GJ

Produtos afetados

Nextcloud Office

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25150.json · Exploit
• https://github.com/nextcloud/richdocuments/pull/2669 · Aviso do Fabricante
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-64xc-r58v-53gj · Aviso do Fabricante
• https://hackerone.com/reports/1788222 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-25150 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-25150 · Aviso do Fabricante