Log in Start free

Vulnerability · Published Jun 23, 2023 · Assigned by GitHub_M

CVE-2023-35927Nextcloud system addressbooks can be modified by malicious trusted server

High 7.6

In plain English

A high-severity improper access control in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High
Exploit odds (30 days)0.8%top 43.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, when two server are registered as trusted servers for each other and successfully exchanged the share secrets, the malicious server could modify or delete VCards in the system addressbook on the origin server. This would impact the available and shown information in certain places, such as the user search and avatar menu. If a manipulated user modifies their own data in the personal settings the entry is fixed again. Nextcloud Server n 25.0.7 and 26.0.2 and Nextcloud Enterprise Server 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2, 25.0.7, and 26.0.2 contain a patch for this issue. A workaround is available. Remove all trusted servers in the "Administration" > "Sharing" settings `…/index.php/settings/admin/sharing`. Afterwards, trigger a recreation of the local system addressbook with the following `occ dav:sync-system-addressbook`.

Affected products (as reported)

VendorProductVersions
nextcloud security-advisories Nextcloud Server >= 25.0.0, < 25.0.7Nextcloud Server >= 26.0.0, < 26.0.2Nextcloud Enterprise Server >= 25.0.0, < 25.0.7Nextcloud Enterprise Server >= 26.0.0, < 26.0.2Nextcloud Enterprise Server >= 21.0.0, < 21.0.9.12Nextcloud Enterprise Server >= 22.0.0, < 22.2.10.12Nextcloud Enterprise Server >= 23.0.0, < 23.0.12.7Nextcloud Enterprise Server >= 24.0.0, < 24.0.12.2

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:L

References