PT-2023-2377 · Nextcloud+2 · Nextcloud+2

Rullzer · Publicado 2023-01-16 · Atualizado 2023-04-13 · CVE-2023-25821

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud versions 24.0.4 through 24.0.6 Nextcloud versions 25.0.0

Description The issue is related to improper access control in Nextcloud, a private cloud software. This can allow a remote attacker to gain unauthorized access to limited functions. Specifically, the secure view for internal shares can be circumvented if reshare permissions are also given.

Recommendations For Nextcloud versions 24.0.4 through 24.0.6, update to version 24.0.7 to resolve the issue. For Nextcloud versions 25.0.0, update to version 25.0.1 to resolve the issue.

Exploit

Correção

Improper Access Control

Resource Exhaustion

Enumeração de Fraquezas

CWE-284

CWE-400

Identificadores relacionados

ALT-PU-2023-1055

ALT-PU-2023-1176

BDU:2023-02152

BDU:2023-02153

CVE-2023-25821

GHSA-7W6H-5QGW-4J94

Produtos afetados

Alt Linux

Nextcloud

Red Os

Referências · 34

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25821.json · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41970.json · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25816.json · Exploit
• 🔥 https://hackerone.com/reports/1724016 · Exploit
• https://github.com/nextcloud/server/issues/34015 · Nota
• https://github.com/nextcloud/server/pull/34502 · Correção
• https://github.com/nextcloud/server/pull/35965 · Nota
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7w6h-5qgw-4j94 · Aviso do Fabricante
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-53q2-cm29-7j83 · Nota
• https://bdu.fstec.ru/vul/2023-02260 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25821 · Nota
• https://hackerone.com/reports/1820864 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25161 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25816 · Nota de Segurança
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-nextcloud-cve-2023-25821-cve-2023-25816 · Nota