What is CVE-2023-35171?

CVE-2023-35171 is a vulnerability in NextCloud Server and NextCloud Enterprise Server that allows an attacker to redirect a victim to a malicious site using a supplied URL.

What is the severity of CVE-2023-35171?

The severity of CVE-2023-35171 is medium with a CVSS score of 6.1.

Is there a fix for CVE-2023-35171?

Yes, the fix for CVE-2023-35171 is available in NextCloud Server version 26.0.2 or later.

Where can I find more information about CVE-2023-35171?

More information about CVE-2023-35171 can be found in the following references: [GitHub Security Advisory](https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h353-vvwv-j2r4), [GitHub Pull Request](https://github.com/nextcloud/server/pull/38194), [HackerOne Report](https://hackerone.com/reports/1977222).

Vulnerability/
CVE-2023-35171

medium

6.1

CWE

601

23/6/2023

7/11/2024

CVE-2023-35171: Nextcloud Server vulnerable to open redirect on "Unsupported browser" warning

Q: How does CVE-2023-35171 affect NextCloud Server and NextCloud Enterprise Server?

CVE-2023-35171 affects NextCloud Server and NextCloud Enterprise Server versions 26.0.0 to 26.0.2.

First published: Fri Jun 23 2023(Updated: )

NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. Starting in version 26.0.0 and prior to version 26.0.2, an attacker could supply a URL that redirects an unsuspecting victim from a legitimate domain to an attacker's site. Nextcloud Server and Nextcloud Enterprise Server 26.0.2 contain a patch for this issue. No known workarounds are available.

Credit: security-advisories@github.com

Affected Software	Affected Version	How to fix
Nextcloud Nextcloud Server	>=26.0.0<26.0.2
Nextcloud Nextcloud Server	>=26.0.0<26.0.2

Remedy

https://github.com/nextcloud/server/pull/38194

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2023-35171?
CVE-2023-35171 is a vulnerability in NextCloud Server and NextCloud Enterprise Server that allows an attacker to redirect a victim to a malicious site using a supplied URL.
What is the severity of CVE-2023-35171?
The severity of CVE-2023-35171 is medium with a CVSS score of 6.1.
How does CVE-2023-35171 affect NextCloud Server and NextCloud Enterprise Server?
CVE-2023-35171 affects NextCloud Server and NextCloud Enterprise Server versions 26.0.0 to 26.0.2.
Is there a fix for CVE-2023-35171?
Yes, the fix for CVE-2023-35171 is available in NextCloud Server version 26.0.2 or later.
Where can I find more information about CVE-2023-35171?
More information about CVE-2023-35171 can be found in the following references: [GitHub Security Advisory](https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h353-vvwv-j2r4), [GitHub Pull Request](https://github.com/nextcloud/server/pull/38194), [HackerOne Report](https://hackerone.com/reports/1977222).

collector/nvd-index
agent/type
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/weakness
agent/references
agent/author
agent/severity
agent/remedy
agent/last-modified-date
agent/title
agent/tags
agent/description
agent/first-publish-date
agent/event
vendor/nextcloud
canonical/nextcloud nextcloud server
version/nextcloud nextcloud server/26.0.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.