PT-2023-18520 · Nextcloud · Deck

Nickvergessen · Published 2023-01-10 · Updated 2023-01-14 · CVE-2023-22469

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud app Deck versions prior to 1.8.2

Description The issue affects Deck, a kanban style organization tool integrated with Nextcloud, used for personal planning and project organization for teams. When getting the reference preview for Deck cards the user has no access to, an unauthorized user could eventually get the cached data of a user that has access. There are currently no known workarounds.

Recommendations For versions prior to 1.8.2, it is recommended that the Nextcloud app Deck is upgraded to 1.8.2.

Exploit

Fix

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

Related Identifiers

CVE-2023-22469

GHSA-8FJP-W9GP-J5HQ

Affected Products

Deck

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22469.json · Exploit
• 🔥 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8fjp-w9gp-j5hq · Exploit
• https://github.com/nextcloud/deck/pull/4196 · Patch
• https://osv.dev/vulnerability/CVE-2023-22469 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22469 · Security Note
• https://t.me/cibsecurity/56289 · Telegram Post
• https://t.me/cvenotify/42013 · Telegram Post