High severity · published Apr 17, 2023
CVE-2023-30539
Nextcloud is a personal home server system
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
Nextcloud is a personal home server system. Depending on the set up tags and other workflows this issue can be used to limit access of others or being able to grant them access when there are system tag based files access control or files retention rules. It is recommended that the Nextcloud Server is upgraded to 24.0.11 or 25.0.5, the Nextcloud Enterprise Server to 21.0.9.11, 22.2.10.11, 23.0.12.6, 24.0.11 or 25.0.5, and the Nextcloud Files automated tagging app to 1.11.1, 1.12.1, 1.13.1, 1.14.2, 1.15.3 or 1.16.1. Users unable to upgrade should disable all workflow related apps. Users are advised to upgrade.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NF
Nextcloud Files Automated Tagging · Nextcloud
1.14.0 before 1.14.2; 1.15.0 before 1.15.3; 1.11.0; 1.12.0; 1.13.0; 1.16.0 · source: NVD
NS
Nextcloud Server · Nextcloud
21.0.0 before 21.0.9.11; 22.0.0 before 22.2.10.11; 23.0.0 before 23.0.12.6; 24.0.0 before 24.0.11; 24.0.0 before 24.0.11; 25.0.0 before 25.0.5; +1 more · source: NVD
Affected product
NF
Nextcloud Files Automated Tagging
Nextcloud
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-30539
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-30539
Issue Tracking
https://github.com/nextcloud/files_automatedtagging/pull/705
Vendor Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3m2f-v8x7-9w99
Patch
https://github.com/nextcloud/server/pull/37252
Permissions Required
https://hackerone.com/reports/1895976