CVE-2023-49104

CVE-2023-49104 affects ownCloud’s OAuth2 component (versions before 0.6.1) where enabling “Allow Subdomains” lets an attacker craft a redirect-url that bypasses validation, enabling callbacks to a top‑level domain controlled by the attacker. Documents consistently state the impact as redirection ...

CVE-2023-49105

An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no...

CVE-2023-49105

An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no...

CVE-2023-49103

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information...

PT-2023-7321 · Owncloud · Owncloud

Name of the Vulnerable Software and Affected Versions: ownCloud owncloud/oauth2 versions prior to 0.6.1 Description: The issue is related to the "Allow Subdomains" configuration in the OAuth2 authorization platform, which is associated with access control weaknesses. An attacker can exploit this ...

ownCloud Security Breach

ownCloud is a personal cloud storage solution from the U.S.-based ownCloud, Inc. A security vulnerability exists in ownCloud oauth2 versions prior to 0.6.1, which stems from the ability to pass in a specially crafted redirect URL in the oauth2 application that bypasses authentication code and can...

Subdomain Validation Bypass - ownCloud

Within the oauth2 app an attacker is able to pass in a specially crafted redirect-url which bypasses the validation code and thus allows the attacker to redirect callbacks to a TLD controlled by the attacker...

WebDAV Api Authentication Bypass using Pre-Signed URLs - ownCloud

It is possible to access, modify or delete any file without authentication if the username of the victim is known and the victim has no signing-key configured which is the default...

Disclosure of sensitive credentials and configuration in containerized deployments - ownCloud

The “graphapi” app relies on a third-party library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information includes all the environment variables of the webserver. In containerized deployments, these environment variabl...

ownCloud Security Breach

ownCloud is a suite of personal cloud storage solutions from the US-based company ownCloud. A security vulnerability exists in ownCloud graphapi versions prior to 0.2.1, 0.3.1 and 0.3.1. The vulnerability stems from the fact that the graphapi application relies on the third-party GetPhpInfo.php...

PT-2023-7082

Name of the Vulnerable Software and Affected Versions ownCloud owncloud/graphapi versions 0.2.x through 0.2.0 and versions 0.3.x through 0.3.0 Description The issue is related to the graphapi app in ownCloud, which relies on a third-party GetPhpInfo.php library. This library provides a URL that,...

CVE-2023-49103

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information...

CVE-2023-49103

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information...

CVE-2023-49103

The CVE-2023-49103 vulnerability affects ownCloud graphapi in versions 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The issue stems from a third‑party GetPhpInfo.php that returns a phpinfo() output, exposing the PHP environment and webserver variables (potentially including admin passwords, mail cr...

CVE-2023-49105

An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no...

Malicious code in owncloud-js-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 26163abe3e5a983c952c08703d6b6763543c0fc989b54027001520a78d7b145a The OpenSSF Package Analysis project identified 'owncloud-js-dev' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1505 Malicious code in owncloud-js-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 26163abe3e5a983c952c08703d6b6763543c0fc989b54027001520a78d7b145a The OpenSSF Package Analysis project identified 'owncloud-js-dev' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

ownCloud: Federated share permissions can be increased by recipient

The federated share permissions in Nextcloud allowed recipients to increase their permissions by sending a request to the server with the share token and ID, resulting in a security vulnerability...

Edit of share permissions causes public links misbehaviour - ownCloud

Changes to the permissions of a share where propagated to public links of child resources...

SQLInjection in FileContentProvider.kt - ownCloud

Due to some insecure code in a exported content provider an attacker with local access could retrieve information from the ownCloud app database through SQL injection...