CVE-2023-25150: Document content of files can be obtained through Collabora for files of other users
Nextcloud office/richdocuments is an office suit for the nextcloud server platform. In affected versions the Collabora integration can be tricked to provide access to any file without proper permission validation. As a result any user with access to Collabora can obtain the content of other users files. It is recommended that the Nextcloud Office App (Collabora Integration) is updated to 7.0.2 (Nextcloud 25), 6.3.2 (Nextcloud 24), 5.0.10 (Nextcloud 23), 4.2.9 (Nextcloud 21-22), or 3.8.7 (Nextcloud 15-20). There are no known workarounds for this issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-25150?
CVE-2023-25150 is a vulnerability in Nextcloud Richdocuments that allows users to access any file without proper permission validation in the Collabora integration.
What is the severity of CVE-2023-25150?
The severity of CVE-2023-25150 is medium with a CVSS score of 5.7.
How can CVE-2023-25150 be exploited?
CVE-2023-25150 can be exploited by tricking the Collabora integration in Nextcloud Richdocuments, allowing unauthorized access to any file.
What versions of Nextcloud Richdocuments are affected by CVE-2023-25150?
Nextcloud Richdocuments versions up to 3.8.7, 4.0.0 to 4.2.9, 5.0.0 to 5.0.10, 6.0.0 to 6.3.2, and 7.0.0 to 7.0.2 are affected by CVE-2023-25150.
How can I fix CVE-2023-25150?
To fix CVE-2023-25150, it is recommended to upgrade to a version of Nextcloud Richdocuments that is not affected by the vulnerability.