Vulnerability · Published Mar 27, 2023 · Assigned by GitHub_M

CVE-2023-25817Delete permissions are not saved when creating public share in Nextcloud server

Low 3.5

In plain English

A low-severity security flaw in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.6%top 52.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their permissions to delete files they were not supposed to deletable but only viewed or downloaded. This issue has been addressed andit is recommended that the Nextcloud Server is upgraded to 24.0.9. There are no known workarounds for this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	>= 24.0.0, < 24.0.9

Weakness: CWE-281 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8v5c-f752-fgpv x_refsource_CONFIRM
https://github.com/nextcloud/server/pull/33941 x_refsource_MISC