CVE-2023-28645 Secure view can be bypassed by using internal API endpoint in Nextcloud richdocuments

2023-03-3122:08:14

CWE-284

GitHub_M

www.cve.org

nextcloud

richdocuments

secure view

api endpoint

vulnerability

upgrade

wopi configuration

collabora

download restriction

allow list.

CVSS3

5.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

40.3%

JSON

Nextcloud richdocuments is a Nextcloud app integrating the office suit Collabora Online. In affected versions the secure view feature of the rich documents app can be bypassed by using unprotected internal API endpoint of the rich documents app. It is recommended that the Nextcloud Office app (richdocuments) is upgraded to 8.0.0-beta.1, 7.0.2 or 6.3.2. Users unable to upgrade may mitigate the issue by taking steps to restrict the ability to download documents. This includes ensuring that the WOPI configuration is configured to only serve documents between Nextcloud and Collabora. It is highly recommended to define the list of Collabora server IPs as the allow list within the Office admin settings of Nextcloud.

CNA Affected

[
  {
    "vendor": "nextcloud",
    "product": "security-advisories",
    "versions": [
      {
        "version": ">= 7.0.0, < 7.0.2",
        "status": "affected"
      },
      {
        "version": "< 6.3.2",
        "status": "affected"
      }
    ]
  }
]