CVE-2023-35171
Assigner: GitHub_M
Published: 2023-06-23T20:44:34.272Z
State: PUBLISHED
title: Nextcloud Server vulnerable to open redirect on "Unsupported browser" warning
problemTypes: descriptions: cweId: CWE-601
description: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
version: 3.1
affected: vendor: nextcloud
product: security-advisories
versions: version: >= 26.0.0, < 26.0.2
status: affected
descriptions: value: NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. Starting in version 26.0.0 and prior to version 26.0.2, an attacker could supply a URL that redirects an unsuspecting victim from a legitimate domain to an attacker's site. Nextcloud Server and Nextcloud Enterprise Server 26.0.2 contain a patch for this issue. No known workarounds are available.
source: advisory: GHSA-h353-vvwv-j2r4
discovery: UNKNOWN