CVE-2023-49104: High severity owncloud vulnerability
Published Nov 21, 2023
·Updated
An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled. An attacker is able to pass in a crafted redirect-url that bypasses validation, and consequently allows an attacker to redirect callbacks to a Top Level Domain controlled by the attacker.
Affected Software
1 affected component
ownCloud oauth2<0.6.1
Event History
Nov 21, 2023
CVE Published
12:00 AM
Data Sourced
12:00 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID for this issue is CVE-2023-49104.
2
What is the severity of CVE-2023-49104?
The severity of CVE-2023-49104 is high with a severity value of 8.7.
3
How does CVE-2023-49104 affect ownCloud oauth2?
CVE-2023-49104 affects ownCloud oauth2 with versions up to but excluding 0.6.1.
4
What can an attacker do with CVE-2023-49104?
An attacker can bypass validation and redirect callbacks to a Top Level Domain controlled by them.
5
How can I fix CVE-2023-49104?
To fix CVE-2023-49104, upgrade to version 0.6.1 or later of ownCloud oauth2.