#VU77663 Improper access control in Nextcloud Enterprise Server and Nextcloud Server - CVE-2023-35927

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU77663

#VU77663 Improper access control in Nextcloud Enterprise Server and Nextcloud Server - CVE-2023-35927

Published: June 23, 2023


Vulnerability identifier: #VU77663
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2023-35927
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Nextcloud Enterprise Server
Nextcloud Server
Software vendor:
Nextcloud

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions when two servers are registered as trusted servers for each other and successfully exchanged the share secrets. A remote user can modify or delete VCards in the system addressbook on the origin server.


Remediation

Install updates from vendor's website.

External links