CVE-2023-39962

🗓️ 10 Aug 2023 17:23:50Reported by MendType

mend🔗 www.mend.io

Malicious user can delete any personal or global external storage in Nextcloud Server.

Reporter	Title	Published	Views	Family All 51
BDU FSTEC	The vulnerability of cloud-based software for creating and using Nextcloud data storage solutions is related to improper access control. This allows a hacker to delete any personal or global external storage, making it inaccessible to everyone else.	20 Sep 202300:00	–	bdu_fstec
CNNVD	Nextcloud Access Control Error Vulnerability	10 Aug 202300:00	–	cnnvd
CVE	CVE-2023-39962	10 Aug 202317:23	–	cve
Cvelist	CVE-2023-39962 Users can delete external storage mount points	10 Aug 202317:23	–	cvelist
EUVD	EUVD-2023-43659	3 Oct 202520:07	–	euvd
Nextcloud	Users can delete external storage mount points	10 Aug 202307:19	–	nextcloud
Hacker One	Nextcloud: Any (non-admin) user from an instance can destroy any (user and/or global) external filesystem	2 Jul 202315:13	–	hackerone
NVD	CVE-2023-39962	10 Aug 202318:15	–	nvd
OpenVAS	Nextcloud Server Multiple Vulnerabilities (GHSA-vv27-g2hq-v48h, GHSA-g97r-8ffm-hfpj, GHSA-qhgm-w4gx-gvgp, GHSA-xwxx-2752-w3xm, GHSA-j4qm-5q5x-54m5)	10 Aug 202300:00	–	openvas
Prion	Code injection	10 Aug 202318:15	–	prion

Source	Link
github	www.github.com/nextcloud/security-advisories/security/advisories/GHSA-xwxx-2752-w3xm
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39962.json
github	www.github.com/nextcloud/server/pull/39323
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-39962
hackerone	www.hackerone.com/reports/2047168

06 Oct 2026 02:43Current

CVSS 3.17.7

CVSS 48.3

EPSS0.01023

SSVC

Nextcloud Server external storage data deletion files_external