CyberSecBulletin
CVE-2023-35928NVD status: Modified

security-advisories: Improper Handling of Insufficient Privileges

Published Updated By the CyberSecBulletin desk

CVE-2023-35928 is a high-severity improper handling of insufficient privileges vulnerability in security-advisories from Nextcloud, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. Affected security-advisories versions: Nextcloud Enterprise Server >= 19.0.0, < 19.0.13.9; Nextcloud Enterprise Server >= 20.0.0.0, < 20.0.14.14; Nextcloud Enterprise Server >= 21.0.0.0, < 21.0.9.12, and others listed below. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.98% chance of exploitation within 30 days, higher than 63% of scored CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Nextcloud Server to 19.0.13.9 or 20.0.14.14 or 21.0.9.12 or 22.2.10.12, whichever matches your release line, or a later version.
  2. Read the advisory on github.com for workarounds and exact fixed builds.

Affected products and versions

VendorProductAffected versionsFixed in
Nextcloudsecurity-advisoriesNextcloud Enterprise Server >= 19.0.0, < 19.0.13.9; Nextcloud Enterprise Server >= 20.0.0.0, < 20.0.14.14; Nextcloud Enterprise Server >= 21.0.0.0, < 21.0.9.12; Nextcloud Enterprise Server >= 22.0.0.0, < 22.2.10.12; Nextcloud Enterprise Server >= 23.0.0.0, < 23.0.12.7; Nextcloud Enterprise Server >= 24.0.0.0, < 24.0.12.2; Nextcloud Enterprise Server >= 25.0.0, < 25.0.7; Nextcloud Enterprise Server >= 26.0.0, < 26.0.2; and 2 more rangesNot stated
NextcloudNextcloud Server19.0.0 up to, but not including, 19.0.13.9; 20.0.0 up to, but not including, 20.0.14.14; 21.0.0 up to, but not including, 21.0.9.12; 22.0.0 up to, but not including, 22.2.10.12; 23.0.0 up to, but not including, 23.0.12.7; 24.0.0 up to, but not including, 24.0.12.2; 25.0.0 up to, but not including, 25.0.7; 26.0.0 up to, but not including, 26.0.219.0.13.9, 20.0.14.14, 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.18.4HighCNA (github.com)
CVSS 3.18.8HighNVD

Official description

Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 19.0.0 until 19.0.13.9, 20.0.0 until 20.0.14.14, 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, a user could use this functionality to get access to the login credentials of another user and take over their account. This issue has been patched in Nextcloud Server versions 25.0.7 and 26.0.2 and NextCloud Enterprise Server versions 19.0.13.9, 20.0.14.14, 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2, 25.0.7, and 26.0.2. Three workarounds are available. Disable app files_external. Change config setting "Allow users to mount external storage" to disabled in "Administration" > "External storage" settings `…/index.php/settings/admin/externalstorages`. Change config setting to disallow users to create external storages in "Administration" > "External storage" settings `…/index.php/settings/admin/externalstorages` with the types FTP, Nextcloud, SFTP, and/or WebDAV.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Handling of Insufficient Privileges

The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation.

More Improper Handling of Insufficient Privileges vulnerabilities (CWE-274)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Patches and release notes

Third-party and government advisories

Other vulnerabilities in security-advisories

All security-advisories vulnerabilities

Spotted an error? Tell us.