CVE-2023-48306 Nextcloud Server DNS pin middleware can be tricked into DNS rebinding allowing SSRF

🗓️ 21 Nov 2023 22:20:28Reported by GoogleType

osv

osv🔗 osv.dev👁 16 Views

Nextcloud Server and Enterprise Server versions 25.0.0 - 27.1.0 DNS rebinding vulnerabilit

Reporter	Title	Published	Views	Family All 50
BDU FSTEC	The vulnerability of cloud software for creating and using Nextcloud Server’s data storage system lies in insufficiently checking incoming requests, allowing attackers to execute SSRF attacks.	25 Jan 202400:00	–	bdu_fstec
CNNVD	Nextcloud Code Issues Vulnerabilities	21 Nov 202300:00	–	cnnvd
CVE	CVE-2023-48306	21 Nov 202322:20	–	cve
Cvelist	CVE-2023-48306 Nextcloud Server DNS pin middleware can be tricked into DNS rebinding allowing SSRF	21 Nov 202322:20	–	cvelist
EUVD	EUVD-2023-52366	3 Oct 202520:07	–	euvd
Nextcloud	DNS pin middleware can be tricked into DNS rebinding allowing SSRF	21 Nov 202305:19	–	nextcloud
Hacker One	Nextcloud: DNS pin middleware can be tricked into DNS rebinding allowing SSRF	18 Aug 202307:46	–	hackerone
NVD	CVE-2023-48306	21 Nov 202323:15	–	nvd
OpenVAS	Nextcloud Server < 22.2.10.16, 23.x < 23.0.12.11, 24.x <24.0.12.7, 25.x < 25.0.11, 26.x < 26.0.6, 27.x < 27.1.0 Multiple Vulnerabilities (GHSA-8JWV-C8C8-9FR3, GHSA-8F69-F9JG-4X3V)	22 Nov 202300:00	–	openvas
Prion	Server side request forgery (ssrf)	21 Nov 202323:15	–	prion

Source	Link
hackerone	www.hackerone.com/reports/2115212
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48306.json
github	www.github.com/nextcloud/security-advisories/security/advisories/GHSA-8f69-f9jg-4x3v
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-48306
github	www.github.com/nextcloud/server/pull/40234

02 Apr 2026 09:39Current

9High risk

Vulners AI Score9

CVSS 3.15

EPSS0.005

nextcloud server nextcloud enterprise server dns rebinding ssrf vulnerability patch software