CVE-2023-28833

low-risk
Published 2023-03-30

Nextcloud server is an open source home cloud implementation. In affected versions admins of a server were able to upload a logo or a favicon and to provided a file name which was not restricted and could overwrite files in the appdata directory. Administrators may have access to overwrite these files by other means but this method could be exploited by tricking an admin into uploading a maliciously named file. It is recommended that the Nextcloud Server is upgraded to 24.0.10 or 25.0.4. Users unable to upgrade should avoid ingesting logo files from untrusted sources.

Do I need to act?

-
0.63% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
2
CVSS 2.4/10 Low
NETWORK / LOW complexity

Affected Products (2)

Affected Vendors

Nextcloud

References (4)

Vendor Advisory https://github.com/nextcloud/security-advisories/security/advisories/GHSA-ch7f-p...
Issue Tracking https://github.com/nextcloud/server/pull/36095
Vendor Advisory https://github.com/nextcloud/security-advisories/security/advisories/GHSA-ch7f-p...
Issue Tracking https://github.com/nextcloud/server/pull/36095
22
/ 100
low-risk
Severity 13/34 · Low
Exploitability 2/34 · Minimal
Exposure 7/34 · Low