4.3

CVE-2023-22471

Nextcloud Deck vulnerable to authorization bypass

Possibility to delete files attached to deck cards of other users

Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Broken access control allows a user to delete attachments of other users. There are currently no known workarounds. It is recommended that the Nextcloud Deck app is upgraded to 1.6.5 or 1.7.3 or 1.8.2.
Mögliche Gegenmaßnahme
Deck: No workaround available
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nextcloud ≫ Deck Version < 1.6.5
Nextcloud ≫ Deck Version >= 1.7.0 < 1.7.3
Nextcloud ≫ Deck Version >= 1.8.0 < 1.8.2
Weitere Schwachstelleninformationen
SystemNextcloud App
≫
Produkt Deck
Version >= 0.0.0, < 1.6.5
Version >= 1.7.0, < 1.7.3
Version >= 1.8.0, < 1.8.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.11% 0.286
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
security-advisories@github.com 3.5 2.1 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.