PT-2023-18522 · Nextcloud · Nextcloud Deck

Errorr0X01 + 1 · Published 2023-01-14 · Updated 2023-01-24 · CVE-2023-22470

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Nextcloud Deck versions prior to 1.6.5 Nextcloud Deck versions prior to 1.7.3 Nextcloud Deck versions prior to 1.8.2

Description Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A database error can be generated, potentially causing a denial of service when performed multiple times.

Recommendations For versions prior to 1.6.5, upgrade to version 1.6.5 or later. For versions prior to 1.7.3, upgrade to version 1.7.3 or later. For versions prior to 1.8.2, upgrade to version 1.8.2 or later.

Exploit

Fix

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-20

Related Identifiers

CVE-2023-22470

GHSA-93J5-WX4C-6G88

Affected Products

Nextcloud Deck

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22470.json · Exploit
• https://github.com/nextcloud/deck/pull/4059 · Patch
• https://osv.dev/vulnerability/CVE-2023-22470 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22470 · Security Note
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-93j5-wx4c-6g88 · Note
• https://t.me/cvenotify/42710 · Telegram Post