CVE-2023-28643 Potential share collision for recipients when caching is enabled in nextcloud server

2023-03-3018:31:31

CWE-706

GitHub_M

www.cve.org

nextcloud

share collision

caching

upgrade

security advisory

CVSS3

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

43.6%

JSON

Nextcloud server is an open source home cloud implementation. In affected versions when a recipient receives 2 shares with the same name, while a memory cache is configured, the second share will replace the first one instead of being renamed to {name} (2). It is recommended that the Nextcloud Server is upgraded to 25.0.3 or 24.0.9. Users unable to upgrade should avoid sharing 2 folders with the same name to the same user.

CNA Affected

[
  {
    "vendor": "nextcloud",
    "product": "security-advisories",
    "versions": [
      {
        "version": "< 24.0.9",
        "status": "affected"
      },
      {
        "version": ">= 25.0.0, < 25.0.3",
        "status": "affected"
      }
    ]
  }
]