CVE-2023-39959
published 2023-08-10CVE-2023-39959: Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and…
PriorityP426medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.49%
38.4th percentile
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and 27.0.1, unauthenticated users could send a DAV request which reveals whether a calendar or an address book with the given identifier exists for the victim. Nextcloud Server versions 25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 25.0.9, 26.0.4, and 27.0.1 contain a patch for this issue. No known workarounds are available.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nextcloud | nextcloud_server | — | — |
| nextcloud | nextcloud_server | >= 25.0.0 < 25.0.9 | 25.0.9 |
| nextcloud | nextcloud_server | >= 26.0.0 < 26.0.4 | 26.0.4 |
| nextcloud | security-advisories | — | — |
| nextcloud | security-advisories | — | — |
| nextcloud | security-advisories | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No advisories linked to this vulnerability.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g97r-8ffm-hfpjhttps://github.com/nextcloud/server/pull/38747https://hackerone.com/reports/1832126https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g97r-8ffm-hfpjhttps://github.com/nextcloud/server/pull/38747https://hackerone.com/reports/1832126
2023-08-10
Published