CVE-2023-48303

LOW

Nextcloud Server 25.0.0-25.0.10 - Improper Access Control in External Storage Authentication

Title source: llm

Description

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, admins can change authentication details of user configured external storage. Nextcloud Server and Nextcloud Enterprise Server versions 25.0.11, 26.0.6, and 27.1.0 contain a patch for this issue. No known workarounds are available.

References (3)

Core 3

Core References

Vendor Advisory x_refsource_confirm

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2448-44rp-c7hh

Issue Tracking, Patch x_refsource_misc

https://github.com/nextcloud/server/pull/39895

Permissions Required x_refsource_misc

https://hackerone.com/reports/2107934

Scores

CVSS v3 2.4

EPSS 0.0019

EPSS Percentile 41.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L

Details

CWE

CWE-284

Status published

Products (1)

nextcloud/nextcloud_server 25.0.0 - 25.0.11 (2 CPE variants)

Published Nov 21, 2023

Tracked Since Feb 18, 2026