Nextcloud user scoped external storage can be used to gather credentials of other users
CVE-2023-35928
What is CVE-2023-35928?
In certain versions of Nextcloud Server and Nextcloud Enterprise Server, an unauthenticated attacker can exploit a flaw within the external storage feature, allowing them to gather login credentials of other users. This vulnerability enables unauthorized account access, which poses significant security risks. Users are advised to apply the recent patches or implement available workarounds, such as disabling external storage capabilities, to safeguard their accounts against potential takeover attempts.
Affected Version(s)
security-advisories Nextcloud Enterprise Server >= 19.0.0, < 19.0.13.9 < Nextcloud Enterprise Server 19.0.0, 19.0.13.9
security-advisories Nextcloud Enterprise Server >= 20.0.0.0, < 20.0.14.14 < Nextcloud Enterprise Server 20.0.0.0, 20.0.14.14
security-advisories Nextcloud Enterprise Server >= 21.0.0.0, < 21.0.9.12 < Nextcloud Enterprise Server 21.0.0.0, 21.0.9.12