Bug 1214178 (CVE-2023-39962) - VUL-0: CVE-2023-39962: nextcloud: unrestricted external storage deletion
Summary: VUL-0: CVE-2023-39962: nextcloud: unrestricted external storage deletion
Status: NEW
Alias: CVE-2023-39962
Product: openSUSE Distribution
Classification: openSUSE
Component: Security (show other bugs)
Version: Leap 15.4
Hardware: Other Other
: P3 - Medium : Normal (vote)
Target Milestone: ---
Assignee: Eric Schirra
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/374998/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-08-11 08:48 UTC by Carlos López
Modified: 2024-04-16 08:10 UTC (History)
0 users

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Carlos López 2023-08-11 08:48:47 UTC
CVE-2023-39962

Nextcloud Server provides data storage for Nextcloud, an open source cloud
platform. Starting in version 19.0.0 and prior to versions 19.0.13.10,
20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and
27.0.1, a malicious user could delete any personal or global external storage,
making them inaccessible for everyone else as well. Nextcloud server versions
25.0.9, 26.0.4, and 27.0.1 and Nextcloud Enterprise Server versions 19.0.13.10,
20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.9, 24.0.12.5, 25.0.9, 26.0.4, and
27.0.1 contain a patch for this issue. As a workaround, disable app
files_external. This also makes the external storage inaccessible but retains
the configurations until a patched version has been deployed.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39962
https://www.cve.org/CVERecord?id=CVE-2023-39962
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xwxx-2752-w3xm
https://github.com/nextcloud/server/pull/39323
https://hackerone.com/reports/2047168
Comment 1 Eric Schirra 2024-04-16 08:10:44 UTC
All versions < 27 are end of life.
Version 28.0.4 os in devel and factory.
I have no rights for SLE.
osc mbranch only show sle.
So no more i can do.