PT-2023-5258 · Nextcloud+2 · Nextcloud Server+2

Artificialowl · Published 2023-08-10 · Updated 2025-01-24 · CVE-2023-39962

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions 19.0.0 through 19.0.13.9 Nextcloud Server versions 20.0.0 through 20.0.14.14 Nextcloud Server versions 21.0.0 through 21.0.9.12 Nextcloud Server versions 22.0.0 through 22.2.10.13 Nextcloud Server versions 23.0.0 through 23.0.12.7 Nextcloud Server versions 24.0.0 through 24.0.12.4 Nextcloud Server version 25.0.8 and earlier Nextcloud Server version 26.0.3 and earlier Nextcloud Server version 27.0.0

Description The issue is related to improper access control in Nextcloud Server, allowing a remote attacker to delete any personal or global external storage, making it inaccessible to everyone else.

Recommendations For Nextcloud Server versions 19.0.0 through 19.0.13.9, update to version 19.0.13.10 or later. For Nextcloud Server versions 20.0.0 through 20.0.14.14, update to version 20.0.14.15 or later. For Nextcloud Server versions 21.0.0 through 21.0.9.12, update to version 21.0.9.13 or later. For Nextcloud Server versions 22.0.0 through 22.2.10.13, update to version 22.2.10.14 or later. For Nextcloud Server versions 23.0.0 through 23.0.12.7, update to version 23.0.12.8 or later. For Nextcloud Server versions 24.0.0 through 24.0.12.4, update to version 24.0.12.5 or later. For Nextcloud Server version 25.0.8 and earlier, update to version 25.0.9 or later. For Nextcloud Server version 26.0.3 and earlier, update to version 26.0.4 or later. For Nextcloud Server version 27.0.0, update to version 27.0.1 or later. As a temporary workaround, consider disabling the files external app to make external storage inaccessible while retaining configurations until a patched version is deployed.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2023-7785

ALT-PU-2025-1855

BDU:2023-05875

CVE-2023-39962

GHSA-XWXX-2752-W3XM

Affected Products

Alt Linux

Nextcloud Server

Red Os

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39962.json · Exploit
• https://github.com/nextcloud/server/pull/39323 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xwxx-2752-w3xm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-39962 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39962 · Security Note
• https://bdu.fstec.ru/vul/2023-05875 · Security Note
• https://hackerone.com/reports/2047168 · Note
• https://redos.red-soft.ru/support/secure · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-nextcloud-cve-2023-39958-cve-2023-39959-cve-2023-39962-cve-2023-39963-cve · Note
• https://twitter.com/cracbot/status/1689879449666564096 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1689739151938134016 · Twitter Post