Vulnerability · Published Mar 30, 2023 · Assigned by GitHub_M

CVE-2023-28643Potential share collision for recipients when caching is enabled in nextcloud server

Medium 5.5

In plain English

A medium-severity security flaw in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.8%top 43.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nextcloud server is an open source home cloud implementation. In affected versions when a recipient receives 2 shares with the same name, while a memory cache is configured, the second share will replace the first one instead of being renamed to `{name} (2)`. It is recommended that the Nextcloud Server is upgraded to 25.0.3 or 24.0.9. Users unable to upgrade should avoid sharing 2 folders with the same name to the same user.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	< 24.0.9>= 25.0.0, < 25.0.3

Weakness: CWE-706 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hhq4-4pr8-wm27 x_refsource_CONFIRM
https://github.com/nextcloud/server/issues/34015 x_refsource_MISC
https://github.com/nextcloud/server/pull/36047 x_refsource_MISC