CVE-2023-39959 Existence of calendars and address books can be checked by unauthenticated users

🗓️ 10 Aug 2023 17:07:42Reported by GitHub_MType

Existence of calendars and address books can be revealed by unauthenticated users in Nextcloud Serve

Reporter	Title	Published	Views	Family All 51
BDU FSTEC	The vulnerability of cloud-based software for creating and using Nextcloud storage solutions is related to improper access control, which allows attackers to gain unauthorized access to protected information.	20 Sep 202300:00	–	bdu_fstec
CNNVD	Nextcloud Access Control Error Vulnerability	10 Aug 202300:00	–	cnnvd
CVE	CVE-2023-39959	10 Aug 202317:07	–	cve
EUVD	EUVD-2023-43656	3 Oct 202520:07	–	euvd
Nextcloud	Existance of calendars and addressbooks can be checked by unauthenticated users	10 Aug 202307:19	–	nextcloud
Hacker One	Nextcloud: Existance of calendars and addressbooks can be checked by unauthenticated users	12 Jan 202301:46	–	hackerone
NVD	CVE-2023-39959	10 Aug 202318:15	–	nvd
OpenVAS	Nextcloud Server Multiple Vulnerabilities (GHSA-vv27-g2hq-v48h, GHSA-g97r-8ffm-hfpj, GHSA-qhgm-w4gx-gvgp, GHSA-xwxx-2752-w3xm, GHSA-j4qm-5q5x-54m5)	10 Aug 202300:00	–	openvas
OSV	CVE-2023-39959 Existence of calendars and address books can be checked by unauthenticated users	10 Aug 202317:07	–	osv
Prion	Cross site request forgery (csrf)	10 Aug 202318:15	–	prion

[
  {
    "vendor": "nextcloud",
    "product": "security-advisories",
    "versions": [
      {
        "version": ">= 25.0.0, < 25.0.9",
        "status": "affected"
      },
      {
        "version": ">= 26.0.0, < 26.0.4",
        "status": "affected"
      },
      {
        "version": ">= 27.0.0, < 27.0.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
hackerone	www.hackerone.com/reports/1832126
github	www.github.com/nextcloud/server/pull/38747
github	www.github.com/nextcloud/security-advisories/security/advisories/GHSA-g97r-8ffm-hfpj

10 Aug 2023 17:11Current

6Medium risk

Vulners AI Score6

CVSS 3.13.5

EPSS0.00488

CWE-284