Vulnerabilities discovered in OwnCloud

🗓️ 23 Nov 2023 00:00:00Reported by NCSCType

OwnCloud core and apps have unauthenticated vulnerabilities enabling data deletion or access; workaround via configuration change.

Reporter	Title	Published	Views	Family All 66
GithubExploit	Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Owncloud Graph_Api	27 Jun 202413:46	–	githubexploit
GithubExploit	Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Owncloud Graph_Api	22 Nov 202317:00	–	githubexploit
0day.today	ownCloud Phpinfo Reader Exploit	7 Dec 202300:00	–	zdt
ATTACKERKB	CVE-2023-49103	21 Nov 202300:00	–	attackerkb
ATTACKERKB	CVE-2023-49105	21 Nov 202322:15	–	attackerkb
ATTACKERKB	CVE-2023-49104	21 Nov 202322:15	–	attackerkb
BDU FSTEC	The vulnerability of the GetPhpInfo.php file of the graphapi application, a software tool for collaborative work with Owncloud files, allows a hacker to access configuration information.	23 Nov 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the application interface for WebDAV web applications used for syncing data with ownCloud allows a perpetrator to bypass authentication procedures and gain access to read, modify, or delete data.	1 Dec 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the “Allow Subdomains” configuration in the OAuth2 authentication platform allows a hacker to bypass security restrictions and redirect users to any arbitrary URL address.	4 Dec 202300:00	–	bdu_fstec
Circl	CVE-2023-49103	22 Nov 202317:10	–	circl

23 Nov 2023 00:00Current

7.3High risk

Vulners AI Score7.3

CVSS 3.19.8 - 10

EPSS0.78428

SSVC