CVE-2023-39952: Advanced permissions not respected when copying entire group folders
First published: Thu Aug 10 2023(Updated: )
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.4, 25.0.8, 26.0.3, and 27.0.1, a user can access files inside a subfolder of a groupfolder accessible to them, even if advanced permissions would block access to the subfolder. Nextcloud Server versions 25.0.8, 26.0.3, and 27.0.1 and Nextcloud Enterprise Server versions 22.2.10.13, 23.0.12.8, 24.0.12.4, 25.0.8, 26.0.3, and 27.0.1 contain a patch for this issue. No known workarounds are available.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nextcloud Nextcloud Server | >=22.0.0<22.2.10.13 | |
| Nextcloud Nextcloud Server | >=23.0.0<23.0.12.8 | |
| Nextcloud Nextcloud Server | >=24.0.0<24.0.12.4 | |
| Nextcloud Nextcloud Server | >=25.0.0<25.0.8 | |
| Nextcloud Nextcloud Server | >=25.0.0<25.0.8 | |
| Nextcloud Nextcloud Server | >=26.0.0<26.0.3 | |
| Nextcloud Nextcloud Server | >=26.0.0<26.0.3 | |
| Nextcloud Nextcloud Server | =27.0.0 | |
| Nextcloud Nextcloud Server | =27.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-39952.
What is the severity of CVE-2023-39952?
The severity of CVE-2023-39952 is medium with a severity value of 6.5.
How does CVE-2023-39952 affect Nextcloud Server?
CVE-2023-39952 allows a user to access files inside a subfolder of a groupfolder accessible to them, even if advanced permissions are in place.
Which versions of Nextcloud Server are affected by CVE-2023-39952?
The versions affected by CVE-2023-39952 are 22.0.0 to 22.2.10.13, 23.0.0 to 23.0.12.8, 24.0.0 to 24.0.12.4, 25.0.0 to 25.0.8, 26.0.0 to 26.0.3, and 27.0.0.
How can I fix CVE-2023-39952?
To fix CVE-2023-39952, it is recommended to update Nextcloud Server to version 22.2.10.13, 23.0.12.8, 24.0.12.4, 25.0.8, 26.0.3, or 27.0.1.
- collector/nvd-api
- collector/nvd-index
- agent/references
- agent/author
- agent/type
- agent/remedy
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/title
- agent/severity
- agent/description
- agent/tags
- agent/first-publish-date
- agent/event
- vendor/nextcloud
- canonical/nextcloud nextcloud server
- version/nextcloud nextcloud server/22.0.0
- version/nextcloud nextcloud server/23.0.0
- version/nextcloud nextcloud server/24.0.0
- version/nextcloud nextcloud server/25.0.0
- version/nextcloud nextcloud server/26.0.0
- version/nextcloud nextcloud server/27.0.0