Vulnerability · Published Jan 14, 2023 · Assigned by GitHub_M
CVE-2023-22471Nextcloud Deck vulnerable to authorization bypass
Low 3.5
In plain English
A low-severity authorization bypass via user-controlled key in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.5%top 53.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Broken access control allows a user to delete attachments of other users. There are currently no known workarounds. It is recommended that the Nextcloud Deck app is upgraded to 1.6.5 or 1.7.3 or 1.8.2.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nextcloud | security-advisories | >= 1.60, < 1.6.5>= 1.7.0, < 1.7.3>= 1.8.0, < 1.8.2 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vw5-pfg6-3wm6 x_refsource_CONFIRM
- https://github.com/nextcloud/deck/pull/4173 x_refsource_MISC