Vulnerability Details : CVE-2023-39962
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 19.0.0 and prior to versions 19.0.13.10, 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, a malicious user could delete any personal or global external storage, making them inaccessible for everyone else as well. Nextcloud server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 19.0.13.10, 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. As a workaround, disable app files_external. This also makes the external storage inaccessible but retains the configurations until a patched version has been deployed.
Vulnerability category: BypassGain privilege
Products affected by CVE-2023-39962
- Nextcloud » Nextcloud Server » Enterprise EditionVersions from including (>=) 21.0.0 and before (<) 21.0.9.13cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*
- Nextcloud » Nextcloud Server » Enterprise EditionVersions from including (>=) 26.0.0 and before (<) 26.0.4cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*
- cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*
- Nextcloud » Nextcloud Server » Enterprise EditionVersions from including (>=) 23.0.0 and before (<) 23.0.12.9cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*
- Nextcloud » Nextcloud Server » Enterprise EditionVersions from including (>=) 22.0.0 and before (<) 22.2.10.14cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*
- Nextcloud » Nextcloud Server » Enterprise EditionVersions from including (>=) 24.0.0 and before (<) 24.0.12.5cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*
- cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*
- Nextcloud » Nextcloud Server » Enterprise EditionVersions from including (>=) 19.0.0 and before (<) 19.0.13.10cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*
- Nextcloud » Nextcloud Server » Enterprise EditionVersions from including (>=) 25.0.0 and before (<) 25.0.9cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*
- Nextcloud » Nextcloud Server » Enterprise EditionVersions from including (>=) 20.0.0 and before (<) 20.0.14.15cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*
- cpe:2.3:a:nextcloud:nextcloud_server:27.0.0:*:*:*:-:*:*:*
- cpe:2.3:a:nextcloud:nextcloud_server:27.0.0:*:*:*:enterprise:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-39962
0.09%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 39 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-39962
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.7
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H |
3.1
|
4.0
|
NIST | |
|
7.7
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H |
3.1
|
4.0
|
GitHub, Inc. |
CWE ids for CVE-2023-39962
-
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.Assigned by: security-advisories@github.com (Primary)
References for CVE-2023-39962
-
https://github.com/nextcloud/server/pull/39323
files_external: getStorage before remove by ArtificialOwl · Pull Request #39323 · nextcloud/server · GitHubPatch
-
https://hackerone.com/reports/2047168
Nextcloud | Report #2047168 - Any (non-admin) user from an instance can destroy any (user and/or global) external filesystem | HackerOneThird Party Advisory
-
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xwxx-2752-w3xm
Users can delete external storage mount points · Advisory · nextcloud/security-advisories · GitHubVendor Advisory
Jump to