PT-2023-19315 · Owncloud · Owncloud Android App

Tony Torralba · Published 2023-02-13 · Updated 2023-02-26 · CVE-2023-23948

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ownCloud Android app version 2.21.1 ownCloud Android app versions 3.0 and earlier

Description The ownCloud Android app is affected by a SQL injection issue in FileContentProvider.kt, which can lead to information disclosure. Two databases, filelist and owncloud database, are impacted. Although the filelist database was deprecated in version 3.0, injections affecting owncloud database remain relevant as of version 3.0.

Recommendations For version 2.21.1, consider updating to a version where the SQL injection issue in FileContentProvider.kt is fixed. For versions 3.0 and earlier, restrict access to the owncloud database to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider disabling the FileContentProvider.kt function until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-23948

Affected Products

Owncloud Android App

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23948.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2022-059_GHSL-2022-060_Owncloud_Android_app · Exploit
• https://osv.dev/vulnerability/CVE-2023-23948 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23948 · Security Note
• https://t.me/cvenotify/44274 · Telegram Post
• https://t.me/cybersecuritytechnologies/7828 · Telegram Post
• https://t.me/thebugbountyhunter/7056 · Telegram Post
• https://t.me/cibsecurity/58013 · Telegram Post
• https://t.me/cvenotify/44253 · Telegram Post