CVE-2023-39959

2023-08-1018:15:10

Google

osv.dev

nextcloud server

data exposure

vulnerability fix

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

7.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.8%

JSON

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and 27.0.1, unauthenticated users could send a DAV request which reveals whether a calendar or an address book with the given identifier exists for the victim. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available.

CPENameOperatorVersion
servereq25.0.7rc1
servereq25.0.2rc1
servereq25.0.8rc2
servereq25.0.2rc2
servereq25.0.4
servereq25.0.3rc2
servereq25.0.1
servereq25.0.5rc1
servereq25.0.9rc2
servereq25.0.6

Name	Operator	Version
server	eq	25.0.7rc1
server	eq	25.0.2rc1
server	eq	25.0.8rc2
server	eq	25.0.2rc2
server	eq	25.0.4
server	eq	25.0.3rc2
server	eq	25.0.1
server	eq	25.0.5rc1
server	eq	25.0.9rc2
server	eq	25.0.6