CVE-2023-49791

MEDIUM

Published 2023-12-22T16:26:28.076Z

Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2023-49791. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1

5.4

/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Base Score Metrics

Exploitability: N/A Impact: N/A

EPSS Score

v2025.03.14

0.002

probability

of exploitation in the wild

There is a 0.2% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-06-25

Exploit Probability

Percentile: 0.424

Higher than 42.4% of all CVEs

Attack Vector Metrics

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Impact Metrics

Confidentiality

NONE

Integrity

LOW

Availability

LOW

Description

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when an attacker manages to get access to an active session of another user via another way, they could delete and modify workflows by sending calls directly to the API bypassing the password confirmation shown in the UI. Nextcloud Server versions 26.0.9 and 27.1.4 and Nextcloud Enterprise Server versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4 contain a patch for this issue. No known workarounds are available.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

nextcloud

security-advisories

Affected Versions:

>= 23.0.0, < 23.0.12.13 >= 24.0.0, < 24.0.12.9 >= 25.0.0, < 25.0.13.4 >= 26.0.0, < 26.0.9 >= 27.0.0, < 27.1.4

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3f8p-6qww-2prr

https://github.com/nextcloud/server/pull/41520

https://hackerone.com/reports/2120667

Published: 2023-12-22T16:26:28.076Z

Last Modified: 2024-09-12T12:36:45.577Z

Copied to clipboard!