CVE-2023-26482: Nextcloud server is an open source home cloud implementation

High severity · published Mar 30, 2023

CVE-2023-26482

Nextcloud server is an open source home cloud implementation

8.8

CVSS

4.2%

EPSS

On KEV

Description

Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which are designed to be only available for administrators. Some workflows are designed to be RCE by invoking defined scripts, in order to generate PDFs, invoking webhooks or running scripts on the server. Due to this combination depending on the available apps the issue can result in a RCE at the end. It is recommended that the Nextcloud Server is upgraded to 24.0.10 or 25.0.4. Users unable to upgrade should disable app `workflow_scripts` and `workflow_pdf_converter` as a mitigation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)4.2% · higher than 91% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Nextcloud Server · Nextcloud

18.0.0 before 20.0.14.12; 21.0.0 before 21.0.9.10; 22.0.0 before 22.2.10.10; 23.0.0 before 23.0.12.5; 24.0.0 before 24.0.10; 24.0.0 before 24.0.10; +2 more · source: NVD

Affected product

Nextcloud Server

Nextcloud

All Nextcloud Server CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-26482

CVE.org

https://www.cve.org/CVERecord?id=CVE-2023-26482

Vendor Advisory

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h3c9-cmh8-7qpj

Patch

https://github.com/nextcloud/server/commit/5a06b50b10cc9278bbe68bbf897a0c4aeb0c4e60