CVE-2023-22471

EPSS 0.04%
Published 14.01.2023 01:15:14
Last modified 21.11.2024 07:44:52
Source security-advisories@github.com
Teams watchlist Login
Open Login

Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Broken access control allows a user to delete attachments of other users. There are currently no known workarounds. It is recommended that the Nextcloud Deck app is upgraded to 1.6.5 or 1.7.3 or 1.8.2.

Affected products Warnungen 0 Metrics 3 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Nextcloud ≫ Deck Version < 1.6.5

Nextcloud ≫ Deck Version >= 1.7.0 < 1.7.3

Nextcloud ≫ Deck Version >= 1.8.0 < 1.8.2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.04%	0.094

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	4.3	2.8	1.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
security-advisories@github.com	3.5	2.1	1.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

https://github.com/nextcloud/deck/pull/4173

Patch

Third Party Advisory

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vw5-pfg6-3wm6

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-22471

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-22471

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-22471

EUVD