First published: Tue Jan 10 2023(Updated: )
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. When getting the reference preview for Deck cards the user has no access to, unauthorized user could eventually get the cached data of a user that has access. There are currently no known workarounds. It is recommended that the Nextcloud app Deck is upgraded to 1.8.2.
Credit: security-advisories@github.com security-advisories@github.com
Affected Software | Affected Version | How to fix |
---|---|---|
Nextcloud Deck | <1.8.2 | |
<1.8.2 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2023-22469 is a vulnerability in Nextcloud Deck, a kanban style organization tool, that allows unauthorized users to potentially access cached data of a user with access to the tool.
CVE-2023-22469 has a severity rating of medium with a value of 3.5.
Nextcloud Deck version up to and exclusive of 1.8.2 is affected by CVE-2023-22469.
An unauthorized user can exploit the CVE-2023-22469 vulnerability by getting the reference preview for Deck cards they have no access to, which may lead to obtaining the cached data of a user that has access.
Yes, a fix for CVE-2023-22469 is available. It is recommended to upgrade to a version of Nextcloud Deck that is higher than 1.8.2.