CVE-2023-49105

CRITICAL NUCLEI

ownCloud <10.13.1 - Info Disclosure

Title source: llm

Description

An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.

Exploits (1)

nomisec WORKING POC 36 stars

by ambionics · poc

https://github.com/ambionics/owncloud-exploits

View Code ZIP pw:eip

Nuclei Templates (1)

OwnCloud - WebDAV API Authentication Bypass

CRITICALby ChristianPoeschl,FlorianDewald,usdAG

Shodan: title:"owncloud" || http.title:"owncloud"

FOFA: title="owncloud"

References (2)

[Vendor Advisory] https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/

[Product] https://owncloud.org/security

Scores

CVSS v3 9.8

EPSS 0.8961

EPSS Percentile 99.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-287

Status published

Products (1)

owncloud/owncloud_server 10.6.0 - 10.13.1

Published Nov 21, 2023

Tracked Since Feb 18, 2026