Medium severity · published Mar 31, 2023
CVE-2023-28645
Nextcloud richdocuments is a Nextcloud app integrating the office suit Collabora Online
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
Nextcloud richdocuments is a Nextcloud app integrating the office suit Collabora Online. In affected versions the secure view feature of the rich documents app can be bypassed by using unprotected internal API endpoint of the rich documents app. It is recommended that the Nextcloud Office app (richdocuments) is upgraded to 8.0.0-beta.1, 7.0.2 or 6.3.2. Users unable to upgrade may mitigate the issue by taking steps to restrict the ability to download documents. This includes ensuring that the `WOPI configuration` is configured to only serve documents between Nextcloud and Collabora. It is highly recommended to define the list of Collabora server IPs as the allow list within the Office admin settings of Nextcloud.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RI
Richdocuments · Nextcloud
6.0.0 before 6.3.2; 7.0.0 before 7.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-28645
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-28645
Product
https://docs.nextcloud.com/server/latest/admin_manual/office/configuration.html#wopi-settings
Patch
https://github.com/nextcloud/richdocuments/pull/2604
Mitigation
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-95j6-p5cj-5hh5
More from Richdocuments
7.5
CVE-2021-37628
Nextcloud Richdocuments is an open source collaborative office suite
6.5
CVE-2022-31024
richdocuments is the repository for NextCloud Collabra, the app for Nextcloud Office collaboration
5.7
CVE-2023-25150
Nextcloud office/richdocuments is an office suit for the nextcloud server platform
5.3
CVE-2023-25159
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Office is a document collaboration app for the same platform
5.3
CVE-2021-39223
Nextcloud is an open-source, self-hosted productivity platform