CVE-2023-39952
published 2023-08-10CVE-2023-39952: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8…
PriorityP338medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.81%
52.3th percentile
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.4, 25.0.8, 26.0.3, and 27.0.1, a user can access files inside a subfolder of a groupfolder accessible to them, even if advanced permissions would block access to the subfolder. Nextcloud Server versions 25.0.8, 26.0.3, and 27.0.1 and Nextcloud Enterprise Server versions 22.2.10.13, 23.0.12.8, 24.0.12.4, 25.0.8, 26.0.3, and 27.0.1 contain a patch for this issue. No known workarounds are available.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nextcloud | nextcloud_server | — | — |
| nextcloud | nextcloud_server | >= 22.0.0 < 22.2.10.13 | 22.2.10.13 |
| nextcloud | nextcloud_server | >= 23.0.0 < 23.0.12.8 | 23.0.12.8 |
| nextcloud | nextcloud_server | >= 24.0.0 < 24.0.12.4 | 24.0.12.4 |
| nextcloud | nextcloud_server | >= 25.0.0 < 25.0.8 | 25.0.8 |
| nextcloud | nextcloud_server | >= 26.0.0 < 26.0.3 | 26.0.3 |
| nextcloud | security-advisories | — | — |
| nextcloud | security-advisories | — | — |
| nextcloud | security-advisories | — | — |
| nextcloud | security-advisories | — | — |
| nextcloud | security-advisories | — | — |
| nextcloud | security-advisories | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No advisories linked to this vulnerability.
Suricata
ET EXPLOIT Fortinet FortiNAC - Observed POST .zip with Vulnerable Parameter (CVE-2022-39952)
suricata·2023-02-21·CVSS 9.8
CVE-2022-39952 [CRITICAL] ET EXPLOIT Fortinet FortiNAC - Observed POST .zip with Vulnerable Parameter (CVE-2022-39952)
ET EXPLOIT Fortinet FortiNAC - Observed POST .zip with Vulnerable Parameter (CVE-2022-39952)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Fortinet FortiNAC - Observed POST .zip with Vulnerable Parameter (CVE-2022-39952)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/configWizard/keyUpload.jsp"; fast_pattern; http.request_body; content:"name=|22|key|22 3b|"; content:"|0d 0a 0d 0a|PK"; reference:cve,2022-39952; classtype:attempted-admin; sid:2044270; rev:2; metadata:attack_target Server, created_at 2023_02_21, cve CVE_2022_39952, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2024_03_08, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T119
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/nextcloud/groupfolders/issues/1906https://github.com/nextcloud/security-advisories/security/advisories/GHSA-cq8w-v4fh-4rjqhttps://github.com/nextcloud/server/pull/38890https://hackerone.com/reports/1808079https://github.com/nextcloud/groupfolders/issues/1906https://github.com/nextcloud/security-advisories/security/advisories/GHSA-cq8w-v4fh-4rjqhttps://github.com/nextcloud/server/pull/38890https://hackerone.com/reports/1808079
2023-08-10
Published