CVE-2023-22469
First published: Tue Jan 10 2023(Updated: )
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. When getting the reference preview for Deck cards the user has no access to, unauthorized user could eventually get the cached data of a user that has access. There are currently no known workarounds. It is recommended that the Nextcloud app Deck is upgraded to 1.8.2.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nextcloud Deck | <1.8.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-22469?
CVE-2023-22469 is a vulnerability in Nextcloud Deck, a kanban style organization tool, that allows unauthorized users to potentially access cached data of a user with access to the tool.
What is the severity of CVE-2023-22469?
CVE-2023-22469 has a severity rating of medium with a value of 3.5.
Which version of Nextcloud Deck is affected by CVE-2023-22469?
Nextcloud Deck version up to and exclusive of 1.8.2 is affected by CVE-2023-22469.
How can an unauthorized user exploit the CVE-2023-22469 vulnerability?
An unauthorized user can exploit the CVE-2023-22469 vulnerability by getting the reference preview for Deck cards they have no access to, which may lead to obtaining the cached data of a user that has access.
Is there a fix available for CVE-2023-22469?
Yes, a fix for CVE-2023-22469 is available. It is recommended to upgrade to a version of Nextcloud Deck that is higher than 1.8.2.
- collector/nvd-index
- vendor/nextcloud
- canonical/nextcloud deck