CVE-2023-49103: ownCloud graphapi Information Disclosure Vulnerability
First published: Tue Nov 21 2023(Updated: )
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment (phpinfo). This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key. Simply disabling the graphapi app does not eliminate the vulnerability. Additionally, phpinfo exposes various other potentially sensitive configuration details that could be exploited by an attacker to gather information about the system. Therefore, even if ownCloud is not running in a containerized environment, this vulnerability should still be a cause for concern. Note that Docker containers from before February 2023 are not vulnerable to the credential disclosure.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ownCloud ownCloud | ||
| ownCloud ownCloud graphapi | ||
| Owncloud Graph Api | =0.2.0 | |
| Owncloud Graph Api | =0.3.0 |
Remedy
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-49103?
The severity of CVE-2023-49103 is critical with a severity value of 10.
How does CVE-2023-49103 affect ownCloud owncloud/graphapi?
CVE-2023-49103 affects ownCloud owncloud/graphapi versions 0.2.x before 0.2.1 and 0.3.x before 0.3.1.
What is the vulnerability in ownCloud owncloud/graphapi?
The vulnerability in ownCloud owncloud/graphapi is a disclosure of sensitive credentials and configuration through the GetPhpInfo.php library.
How can I fix CVE-2023-49103 in ownCloud?
To fix CVE-2023-49103 in ownCloud, you should upgrade to version 10.6.0 or 10.7.0 of ownCloud or upgrade to version 0.2.1 or 0.3.1 of owncloud/graphapi.
Where can I find more information about CVE-2023-49103?
You can find more information about CVE-2023-49103 at the following references: [ownCloud Security](https://owncloud.org/security) and [ownCloud Security Advisories](https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/).
- collector/mitre-cve
- agent/author
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/references
- agent/softwarecombine
- agent/description
- agent/title
- agent/remedy
- agent/severity
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/event
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- vendor/owncloud
- canonical/owncloud owncloud
- canonical/owncloud owncloud graphapi
- canonical/owncloud graph api
- version/owncloud graph api/0.2.0
- version/owncloud graph api/0.3.0