PT-2022-5543 · Owncloud · Owncloud Server

Published 2022-10-20 · Updated 2025-05-01 · CVE-2022-43679

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 10.11

Description The issue is related to a misconfiguration in the ownCloud Server Docker image that affects the trusted domains config, making it useless. This could be exploited to spoof the URL in password-reset email messages. The vulnerability is also related to errors in handling the OWNCLOUD DOMAIN variable, which could allow a remote attacker to conduct spoofing attacks by sending a specially crafted email message.

Recommendations For ownCloud Server versions prior to 10.11, update to a version that fixes the misconfiguration and OWNCLOUD DOMAIN variable handling issues to prevent spoofing attacks. As a temporary workaround, consider restricting access to the password-reset functionality until a patch is available.

Fix

Improper Access Control

RCE

Weakness Enumeration

CWE-16

CWE-284

CWE-20

Related Identifiers

BDU:2022-06872

CVE-2022-43679

Affected Products

Owncloud Server

References · 11

• https://owncloud.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-43679 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06872 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-43679 · Security Note
• https://github.com/owncloud/core/issues/40439 · Note
• https://github.com/owncloud-docker/server · Note
• https://github.com/owncloud-docker/base/blob/master/latest/overlay/etc/templates/config.php#L4-L8 · Note
• https://github.com/owncloud-docker/base/pull/243 · Note
• https://cxsecurity.com/cveshow/CVE-2022-43679 · Note
• https://t.me/cvenotify/120492 · Telegram Post
• https://github.com/advisories/GHSA-wj56-g2wq-p3pw · Note