Riskcovery

CVE-2023-35928

Nextcloud user scoped external storage can be used to gather credentials of other users

State
Published
Severity
8.5 High
Published
Jun 23, 2023
Updated
Dec 5, 2024
Reserved
Jun 20, 2023

Read the record on cve.org

Description

Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 19.0.0 until 19.0.13.9, 20.0.0 until 20.0.14.14, 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, a user could use this functionality to get access to the login credentials of another user and take over their account. This issue has been patched in Nextcloud Server versions 25.0.7 and 26.0.2 and NextCloud Enterprise Server versions 19.0.13.9, 20.0.14.14, 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2, 25.0.7, and 26.0.2.

Three workarounds are available. Disable app files_external. Change config setting "Allow users to mount external storage" to disabled in "Administration" > "External storage" settings `…/index.php/settings/admin/externalstorages`. Change config setting to disallow users to create external storages in "Administration" > "External storage" settings `…/index.php/settings/admin/externalstorages` with the types FTP, Nextcloud, SFTP, and/or WebDAV.

Scores

CVSSScoreVectorSource
3.18.5 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:HGitHub_M

Weaknesses

  • CWE-274 Improper Handling of Insufficient Privileges

Affected Products

ProductVersions
security-advisoriesnextcloud
  • Nextcloud Enterprise Server >= 19.0.0, < 19.0.13.9Affected
  • Nextcloud Enterprise Server >= 20.0.0.0, < 20.0.14.14Affected
  • Nextcloud Enterprise Server >= 21.0.0.0, < 21.0.9.12Affected
  • Nextcloud Enterprise Server >= 22.0.0.0, < 22.2.10.12Affected
  • Nextcloud Enterprise Server >= 23.0.0.0, < 23.0.12.7Affected
  • Nextcloud Enterprise Server >= 24.0.0.0, < 24.0.12.2Affected
  • Nextcloud Enterprise Server >= 25.0.0, < 25.0.7 Affected
  • Nextcloud Enterprise Server >= 26.0.0, < 26.0.2Affected
  • Nextcloud Server >= 25.0.0, < 25.0.7Affected
  • Nextcloud Server >= 26.0.0, < 26.0.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.