CVE-2023-49791
Assigner: GitHub_M
Published: 2023-12-22T16:26:28.076Z
State: PUBLISHED
title: Workflows do not require password confirmation on API level
problemTypes: descriptions: cweId: CWE-284
description: CWE-284: Improper Access Control
type: CWE
descriptions: cweId: CWE-287
description: CWE-287: Improper Authentication
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
version: 3.1
affected: vendor: nextcloud
product: security-advisories
versions: version: >= 23.0.0, < 23.0.12.13
status: affected
version: >= 24.0.0, < 24.0.12.9
status: affected
version: >= 25.0.0, < 25.0.13.4
status: affected
version: >= 26.0.0, < 26.0.9
status: affected
version: >= 27.0.0, < 27.1.4
status: affected
descriptions: value: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when an attacker manages to get access to an active session of another user via another way, they could delete and modify workflows by sending calls directly to the API bypassing the password confirmation shown in the UI. Nextcloud Server versions 26.0.9 and 27.1.4 and Nextcloud Enterprise Server versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4 contain a patch for this issue. No known workarounds are available.
source: advisory: GHSA-3f8p-6qww-2prr
discovery: UNKNOWN