CVE-2023-22469 — Insecure Storage of Sensitive Information in Security-advisories

CWE-922 — Insecure Storage of Sensitive Information2 documents2 sources

Severity

3.5LOWNVD

CNA5.8

EPSS

0.2%

top 55.18%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Nextcloud Security-advisories Nextcloud Deck

Timeline

PublishedJan 10

Description

Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. When getting the reference preview for Deck cards the user has no access to, unauthorized user could eventually get the cached data of a user that has access. There are currently no known workarounds. It is recommended that the Nextcloud app Deck is upgraded to 1.8.2.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:NExploitability: 2.1 | Impact: 1.4

Affected Packages2 packages

▶NVDnextcloud/deck< 1.8.2

▶CVEListV5nextcloud/security-advisories< 1.8.2

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

CVEList

Nextcloud Deck card vulnerable to data leak to unauthorized users via reference preview cache↗2023-01-10

▶