CVE-2023-49791

Workflows do not require password confirmation on API level

State: Published
Severity: 5.4 Medium
Published: Dec 22, 2023
Updated: Sep 12, 2024
Reserved: Nov 30, 2023

Description

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when an attacker manages to get access to an active session of another user via another way, they could delete and modify workflows by sending calls directly to the API bypassing the password confirmation shown in the UI. Nextcloud Server versions 26.0.9 and 27.1.4 and Nextcloud Enterprise Server versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4 contain a patch for this issue. No known workarounds are available.

Scores

CVSS	Score	Vector	Source
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L	GitHub_M

Weaknesses

CWE-284 Improper Access Control
CWE-287 Improper Authentication

Affected Products

Product	Versions
security-advisoriesnextcloud	>= 23.0.0, < 23.0.12.13Affected >= 24.0.0, < 24.0.12.9Affected >= 25.0.0, < 25.0.13.4Affected >= 26.0.0, < 26.0.9Affected >= 27.0.0, < 27.1.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.