CVE-2023-49103

🗓️ 21 Nov 2023 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 608 Views🌐 WEB

An issue in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1 allows disclosure of sensitive data

Reporter	Title	Published	Views	Family All 46
GithubExploit	Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Owncloud Graph_Api	27 Jun 202413:46	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Owncloud Owncloud_Server	5 Dec 202311:35	–	githubexploit
GithubExploit	Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Owncloud Graph_Api	22 Nov 202317:00	–	githubexploit
GithubExploit	Vulhub-vulnerability-reproduction-reports	23 Jul 202611:51	–	githubexploit
zdt	ownCloud Phpinfo Reader Exploit	7 Dec 202300:00	–	zdt
ATTACKERKB	CVE-2023-49103	21 Nov 202300:00	–	attackerkb
BDU FSTEC	The vulnerability of the GetPhpInfo.php file of the graphapi application, a software tool for collaborative work with Owncloud files, allows a hacker to access configuration information.	23 Nov 202300:00	–	bdu_fstec
Circl	CVE-2023-49103	22 Nov 202317:10	–	circl
CISA KEV Catalog	ownCloud graphapi Information Disclosure Vulnerability	30 Nov 202300:00	–	cisa_kev
CISA	CISA Adds Two Known Exploited Vulnerabilities to Catalog	30 Nov 202312:00	–	cisa

NVD

Node

owncloud graph_apiMatch0.2.0

owncloud graph_apiMatch0.3.0

Source	Link
owncloud	www.owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/
owncloud	www.owncloud.org/security
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
GetPhpInfo.php/.css	path	/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php/.css	PHP info output accessible via vulnerable endpoint, bypassing login with appended path	CWE-200
GetPhpInfo.php/.js	path	/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php/.js	PHP info output accessible via vulnerable endpoint, bypassing login with appended path	CWE-200
GetPhpInfo.php/.svg	path	/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php/.svg	PHP info output accessible via vulnerable endpoint, bypassing login with appended path	CWE-200
GetPhpInfo.php/.gif	path	/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php/.gif	PHP info output accessible via vulnerable endpoint, bypassing login with appended path	CWE-200
GetPhpInfo.php/.png	path	/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php/.png	PHP info output accessible via vulnerable endpoint, bypassing login with appended path	CWE-200
GetPhpInfo.php/.html	path	/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php/.html	PHP info output accessible via vulnerable endpoint, bypassing login with appended path	CWE-200
GetPhpInfo.php/.ttf	path	/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php/.ttf	PHP info output accessible via vulnerable endpoint, bypassing login with appended path	CWE-200
GetPhpInfo.php/.woff	path	/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php/.woff	PHP info output accessible via vulnerable endpoint, bypassing login with appended path	CWE-200
GetPhpInfo.php/.ico	path	/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php/.ico	PHP info output accessible via vulnerable endpoint, bypassing login with appended path	CWE-200
GetPhpInfo.php/.jpg	path	/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php/.jpg	PHP info output accessible via vulnerable endpoint, bypassing login with appended path	CWE-200

17 Jun 2026 06:35Current

7.2High risk

Vulners AI Score7.2

CVSS 3.17.5 - 10

EPSS0.78428

SSVC