PT-2023-22766 · Nextcloud+1 · Nextcloud Server+3

Maximelehericy · Published 2023-03-27 · Updated 2023-04-27 · CVE-2023-30539

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 24.0.11 Nextcloud Server versions prior to 25.0.5 Nextcloud Enterprise Server versions prior to 21.0.9.11 Nextcloud Enterprise Server versions prior to 22.2.10.11 Nextcloud Enterprise Server versions prior to 23.0.12.6 Nextcloud Enterprise Server versions prior to 24.0.11 Nextcloud Enterprise Server versions prior to 25.0.5 Nextcloud Files automated tagging app versions prior to 1.11.1 Nextcloud Files automated tagging app versions prior to 1.12.1 Nextcloud Files automated tagging app versions prior to 1.13.1 Nextcloud Files automated tagging app versions prior to 1.14.2 Nextcloud Files automated tagging app versions prior to 1.15.3 Nextcloud Files automated tagging app versions prior to 1.16.1

Description Nextcloud is a personal home server system. Depending on the setup tags and other workflows, this issue can be used to limit access of others or grant them access when there are system tag-based files access control or files retention rules.

Recommendations For Nextcloud Server version prior to 24.0.11, upgrade to 24.0.11 or 25.0.5. For Nextcloud Enterprise Server version prior to 21.0.9.11, upgrade to 21.0.9.11, 22.2.10.11, 23.0.12.6, 24.0.11 or 25.0.5. For Nextcloud Files automated tagging app version prior to 1.11.1, upgrade to 1.11.1, 1.12.1, 1.13.1, 1.14.2, 1.15.3 or 1.16.1. For users unable to upgrade, disable all workflow-related apps.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2023-1517

ALT-PU-2023-1547

CVE-2023-30539

GHSA-3M2F-V8X7-9W99

Affected Products

Alt Linux

Nextcloud Enterprise Server

Nextcloud Files Automated Tagging App

Nextcloud Server

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30539.json · Exploit
• https://github.com/nextcloud/server/pull/37252 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3m2f-v8x7-9w99 · Vendor Advisory
• https://github.com/nextcloud/files_automatedtagging/pull/705 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-30539 · Security Note
• https://osv.dev/vulnerability/CVE-2023-30539 · Vendor Advisory
• https://hackerone.com/reports/1895976 · Note
• https://t.me/cvenotify/48474 · Telegram Post
• https://t.me/cvenotify/49205 · Telegram Post
• https://t.me/cvenotify/48475 · Telegram Post