certfr_avis - CERTFR-2023-AVI-0321

CERTFR-2023-AVI-0321

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans les produits Nextcloud. Elles permettent à un attaquant de provoquer une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Nextcloud	N/A	Nextcloud Talk versions 15.0.x antérieures à 15.0.5
Nextcloud	N/A	Nextcloud Enterprise Server versions 25.0.x antérieures à 25.0.5
Nextcloud	N/A	Nextcloud Files automated tagging app versions 1.14.x antérieures à 1.14.2
Nextcloud	N/A	Nextcloud Files automated tagging app versions 1.13.x antérieures à 1.13.1
Nextcloud	N/A	Nextcloud Server versions 25.0.x antérieures à 25.0.5
Nextcloud	N/A	Nextcloud Server versions 24.0.x antérieures à 24.0.11
Nextcloud	N/A	Nextcloud Files automated tagging app versions 1.16.x antérieures à 1.16.1
Nextcloud	N/A	Nextcloud Enterprise Server versions 23.0.12.x antérieures à 23.0.12.6
Nextcloud	N/A	Nextcloud Enterprise Server versions 24.0.x antérieures à 24.0.11
Nextcloud	N/A	Nextcloud Files automated tagging app versions 1.12.x antérieures à 1.12.1
Nextcloud	N/A	Nextcloud Enterprise Server versions 21.0.9.x antérieures à 21.0.9.11
Nextcloud	N/A	Nextcloud Enterprise Server versions 22.2.10.x antérieures à 22.2.10.11
Nextcloud	N/A	Nextcloud Files automated tagging app versions 1.15.x antérieures à 1.15.3
Nextcloud	N/A	Nextcloud Files automated tagging app versions 1.11.x antérieures à 1.11.1

References

Title

Publication Time

Tags

Bulletin de sécurité Nextcloud GHSA-c9hr-cq65-9mjw du 17 avril 2023	None	vendor-advisory
Bulletin de sécurité Nextcloud GHSA-3m2f-v8x7-9w99 du 17 avril 2023	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Nextcloud Talk versions 15.0.x ant\u00e9rieures \u00e0 15.0.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Nextcloud Enterprise Server versions 25.0.x ant\u00e9rieures \u00e0 25.0.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Nextcloud Files automated tagging app versions 1.14.x ant\u00e9rieures \u00e0 1.14.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Nextcloud Files automated tagging app versions 1.13.x ant\u00e9rieures \u00e0 1.13.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Nextcloud Server versions 25.0.x ant\u00e9rieures \u00e0 25.0.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Nextcloud Server versions 24.0.x ant\u00e9rieures \u00e0 24.0.11",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Nextcloud Files automated tagging app versions 1.16.x ant\u00e9rieures \u00e0 1.16.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Nextcloud Enterprise Server versions 23.0.12.x ant\u00e9rieures \u00e0 23.0.12.6",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Nextcloud Enterprise Server versions 24.0.x ant\u00e9rieures \u00e0 24.0.11",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Nextcloud Files automated tagging app versions 1.12.x ant\u00e9rieures \u00e0 1.12.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Nextcloud Enterprise Server versions 21.0.9.x ant\u00e9rieures \u00e0 21.0.9.11",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Nextcloud Enterprise Server versions 22.2.10.x ant\u00e9rieures \u00e0 22.2.10.11",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Nextcloud Files automated tagging app versions 1.15.x ant\u00e9rieures \u00e0 1.15.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Nextcloud Files automated tagging app versions 1.11.x ant\u00e9rieures \u00e0 1.11.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-30540",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-30540"
    },
    {
      "name": "CVE-2023-30539",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-30539"
    }
  ],
  "links": [],
  "reference": "CERTFR-2023-AVI-0321",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-04-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits \u003cspan\nclass=\"textit\"\u003eNextcloud\u003c/span\u003e. Elles permettent \u00e0 un attaquant de\nprovoquer une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Nextcloud",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-c9hr-cq65-9mjw du 17 avril 2023",
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c9hr-cq65-9mjw"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-3m2f-v8x7-9w99 du 17 avril 2023",
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3m2f-v8x7-9w99"
    }
  ]
}

CVE-2023-30539 (GCVE-0-2023-30539)

Vulnerability from cvelistv5 – Published: 2023-04-17 21:27 – Updated: 2025-02-05 20:38

Summary

Nextcloud is a personal home server system. Depending on the set up tags and other workflows this issue can be used to limit access of others or being able to grant them access when there are system tag based files access control or files retention rules. It is recommended that the Nextcloud Server is upgraded to 24.0.11 or 25.0.5, the Nextcloud Enterprise Server to 21.0.9.11, 22.2.10.11, 23.0.12.6, 24.0.11 or 25.0.5, and the Nextcloud Files automated tagging app to 1.11.1, 1.12.1, 1.13.1, 1.14.2, 1.15.3 or 1.16.1. Users unable to upgrade should disable all workflow related apps. Users are advised to upgrade.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-284 - Improper Access Control

Assigner

GitHub_M

References

URL

Tags

	https://github.com/nextcloud/security-advisories/…	x_refsource_CONFIRM
	https://github.com/nextcloud/files_automatedtaggi…	x_refsource_MISC
	https://github.com/nextcloud/server/pull/37252	x_refsource_MISC
	https://hackerone.com/reports/1895976	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	nextcloud	security-advisories	Affected: Nextcloud Server: < 24.0.11 Affected: Nextcloud Server: >= 25.0.0, < 25.0.5 Affected: Nextcloud Files automated tagging: >= 1.11.0, < 1.11.1 Affected: Nextcloud Files automated tagging: >= 1.12.0, < 1.12.1 Affected: Nextcloud Files automated tagging: >= 1.13.0, < 1.13.1 Affected: Nextcloud Files automated tagging: >= 1.14.0, < 1.14.2 Affected: Nextcloud Files automated tagging: >= 1.15.0, < 1.15.3 Affected: Nextcloud Files automated tagging: >= 1.16.0, < 1.16.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T14:28:51.685Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3m2f-v8x7-9w99",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3m2f-v8x7-9w99"
          },
          {
            "name": "https://github.com/nextcloud/files_automatedtagging/pull/705",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nextcloud/files_automatedtagging/pull/705"
          },
          {
            "name": "https://github.com/nextcloud/server/pull/37252",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nextcloud/server/pull/37252"
          },
          {
            "name": "https://hackerone.com/reports/1895976",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/1895976"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-30539",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-05T20:38:42.496363Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-05T20:38:48.283Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "security-advisories",
          "vendor": "nextcloud",
          "versions": [
            {
              "status": "affected",
              "version": "Nextcloud Server: \u003c 24.0.11"
            },
            {
              "status": "affected",
              "version": "Nextcloud Server: \u003e= 25.0.0, \u003c 25.0.5"
            },
            {
              "status": "affected",
              "version": "Nextcloud Files automated tagging: \u003e= 1.11.0, \u003c 1.11.1"
            },
            {
              "status": "affected",
              "version": "Nextcloud Files automated tagging: \u003e= 1.12.0, \u003c 1.12.1"
            },
            {
              "status": "affected",
              "version": "Nextcloud Files automated tagging: \u003e= 1.13.0, \u003c 1.13.1"
            },
            {
              "status": "affected",
              "version": "Nextcloud Files automated tagging: \u003e= 1.14.0, \u003c 1.14.2"
            },
            {
              "status": "affected",
              "version": "Nextcloud Files automated tagging: \u003e= 1.15.0, \u003c 1.15.3"
            },
            {
              "status": "affected",
              "version": "Nextcloud Files automated tagging: \u003e= 1.16.0, \u003c 1.16.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nextcloud is a personal home server system. Depending on the set up tags and other workflows this issue can be used to limit access of others or being able to grant them access when there are system tag based files access control or files retention rules. It is recommended that the Nextcloud Server is upgraded to 24.0.11 or 25.0.5, the Nextcloud Enterprise Server to 21.0.9.11, 22.2.10.11, 23.0.12.6, 24.0.11 or 25.0.5, and the Nextcloud Files automated tagging app to 1.11.1, 1.12.1, 1.13.1, 1.14.2, 1.15.3 or 1.16.1. Users unable to upgrade should disable all workflow related apps. Users are advised to upgrade."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-17T21:27:29.405Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3m2f-v8x7-9w99",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3m2f-v8x7-9w99"
        },
        {
          "name": "https://github.com/nextcloud/files_automatedtagging/pull/705",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextcloud/files_automatedtagging/pull/705"
        },
        {
          "name": "https://github.com/nextcloud/server/pull/37252",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextcloud/server/pull/37252"
        },
        {
          "name": "https://hackerone.com/reports/1895976",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/1895976"
        }
      ],
      "source": {
        "advisory": "GHSA-3m2f-v8x7-9w99",
        "discovery": "UNKNOWN"
      },
      "title": "Users can set up workflows using restricted and invisible system tags in Nextcloud"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-30539",
    "datePublished": "2023-04-17T21:27:29.405Z",
    "dateReserved": "2023-04-12T15:19:33.766Z",
    "dateUpdated": "2025-02-05T20:38:48.283Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-30540 (GCVE-0-2023-30540)

Vulnerability from cvelistv5 – Published: 2023-04-17 21:32 – Updated: 2025-03-03 19:18

Summary

Nextcloud Talk is a chat, video & audio call extension for Nextcloud. In affected versions a user that was added later to a conversation can use this information to get access to data that was deleted before they were added to the conversation. This issue has been patched in version 15.0.5 and it is recommended that users upgrad to 15.0.5. There are no known workarounds for this issue.

Severity ?

3.5 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M

References

URL

Tags

	https://github.com/nextcloud/security-advisories/…	x_refsource_CONFIRM
	https://github.com/nextcloud/spreed/pull/8985	x_refsource_MISC
	https://hackerone.com/reports/1894676	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	nextcloud	security-advisories	Affected: >= 15.0.0, < 15.0.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T14:28:51.769Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c9hr-cq65-9mjw",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c9hr-cq65-9mjw"
          },
          {
            "name": "https://github.com/nextcloud/spreed/pull/8985",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nextcloud/spreed/pull/8985"
          },
          {
            "name": "https://hackerone.com/reports/1894676",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/1894676"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-30540",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-12T16:08:30.891295Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-03T19:18:53.256Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "security-advisories",
          "vendor": "nextcloud",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 15.0.0, \u003c 15.0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nextcloud Talk is a chat, video \u0026 audio call extension for Nextcloud. In affected versions a user that was added later to a conversation can use this information to get access to data that was deleted before they were added to the conversation. This issue has been patched in version 15.0.5 and it is recommended that users upgrad to 15.0.5. There are no known workarounds for this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-17T21:32:29.470Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c9hr-cq65-9mjw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c9hr-cq65-9mjw"
        },
        {
          "name": "https://github.com/nextcloud/spreed/pull/8985",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextcloud/spreed/pull/8985"
        },
        {
          "name": "https://hackerone.com/reports/1894676",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/1894676"
        }
      ],
      "source": {
        "advisory": "GHSA-c9hr-cq65-9mjw",
        "discovery": "UNKNOWN"
      },
      "title": "Chat poll data can still be queried from API after purging history in Nextcloud talk"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-30540",
    "datePublished": "2023-04-17T21:32:29.470Z",
    "dateReserved": "2023-04-12T15:19:33.766Z",
    "dateUpdated": "2025-03-03T19:18:53.256Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTFR-2023-AVI-0321

Solution

CVE-2023-30539 (GCVE-0-2023-30539)

CVE-2023-30540 (GCVE-0-2023-30540)

Tags

Sightings

Nomenclature