Medium severity · published Feb 13, 2023
CVE-2023-23948
The ownCloud Android app allows ownCloud users to access, share, and edit files and folders
5.5
CVSS
0.5%
EPSS
No
On KEV
Description
The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Version 2.21.1 of the ownCloud Android app is vulnerable to SQL injection in `FileContentProvider.kt`. This issue can lead to information disclosure. Two databases, `filelist` and `owncloud_database`, are affected. In version 3.0, the `filelist` database was deprecated. However, injections affecting `owncloud_database` remain relevant as of version 3.0.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OC
Owncloud Client · Owncloud
through 3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-23948
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-23948
Exploit
https://securitylab.github.com/advisories/GHSL-2022-059_GHSL-2022-060_Owncloud_Android_app/
More from Owncloud Client
6.8
CVE-2022-25338
ownCloud owncloud/android before 2.20 has Incorrect Access Control for physically proximate attackers
5.5
CVE-2022-25339
ownCloud owncloud/android 2.20 has Incorrect Access Control for local attackers
4.6
CVE-2020-36248
The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a backup archive, and consequently bypass the PIN lock feature…
4.6
CVE-2020-36250
In the ownCloud application before 2.15 for Android, the lock protection mechanism can be bypassed by moving the system date/time into the past
4.4
CVE-2023-24804
The ownCloud Android app allows ownCloud users to access, share, and edit files and folders