CVE-2023-35928: Nextcloud user scoped external storage can be used to gather credentials of other users
First published: Fri Jun 23 2023(Updated: )
Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 19.0.0 until 19.0.13.9, 20.0.0 until 20.0.14.14, 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, a user could use this functionality to get access to the login credentials of another user and take over their account. This issue has been patched in Nextcloud Server versions 25.0.7 and 26.0.2 and NextCloud Enterprise Server versions 19.0.13.9, 20.0.14.14, 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2, 25.0.7, and 26.0.2. Three workarounds are available. Disable app files_external. Change config setting "Allow users to mount external storage" to disabled in "Administration" > "External storage" settings `…/index.php/settings/admin/externalstorages`. Change config setting to disallow users to create external storages in "Administration" > "External storage" settings `…/index.php/settings/admin/externalstorages` with the types FTP, Nextcloud, SFTP, and/or WebDAV.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nextcloud Nextcloud Server | >=19.0.0<19.0.13.9 | |
| Nextcloud Nextcloud Server | >=20.0.0<20.0.14.14 | |
| Nextcloud Nextcloud Server | >=21.0.0<21.0.9.12 | |
| Nextcloud Nextcloud Server | >=22.0.0<22.2.10.12 | |
| Nextcloud Nextcloud Server | >=23.0.0<23.0.12.7 | |
| Nextcloud Nextcloud Server | >=24.0.0<24.0.12.2 | |
| Nextcloud Nextcloud Server | >=25.0.0<25.0.7 | |
| Nextcloud Nextcloud Server | >=25.0.0<25.0.7 | |
| Nextcloud Nextcloud Server | >=26.0.0<26.0.2 | |
| Nextcloud Nextcloud Server | >=26.0.0<26.0.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-35928?
CVE-2023-35928 is a vulnerability in Nextcloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 19.0.0 until 19.0.13.9, 20.0.0 until 20.0.14.14, 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, and 24.0.0 until 24.0.12.2 that can allow an attacker to execute arbitrary code.
What is the severity of CVE-2023-35928?
The severity of CVE-2023-35928 is rated as high with a CVSS score of 8.8.
How do I know if I am affected by CVE-2023-35928?
If you are using Nextcloud Server versions 25.0.0 until 25.0.7 or 26.0.0 until 26.0.2, or Nextcloud Enterprise Server versions 19.0.0 until 19.0.13.9, 20.0.0 until 20.0.14.14, 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, or 24.0.0 until 24.0.12.2, you may be affected by CVE-2023-35928.
How can I fix CVE-2023-35928?
To fix CVE-2023-35928, upgrade to a patched version of Nextcloud Server or Nextcloud Enterprise Server. Check the Nextcloud security advisories for the specific patched versions for each affected series.
Where can I find more information about CVE-2023-35928?
You can find more information about CVE-2023-35928 in the Nextcloud security advisories, GitHub security advisories, and the HackerOne report.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/author
- agent/title
- agent/severity
- agent/first-publish-date
- agent/event
- agent/tags
- agent/description
- vendor/nextcloud
- canonical/nextcloud nextcloud server
- version/nextcloud nextcloud server/19.0.0
- version/nextcloud nextcloud server/20.0.0
- version/nextcloud nextcloud server/21.0.0
- version/nextcloud nextcloud server/22.0.0
- version/nextcloud nextcloud server/23.0.0
- version/nextcloud nextcloud server/24.0.0
- version/nextcloud nextcloud server/25.0.0
- version/nextcloud nextcloud server/26.0.0