CVE-2023-22471

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-22471
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-22471.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-22471
Aliases
  • GHSA-2vw5-pfg6-3wm6
Published
2023-01-14T00:34:06.722Z
Modified
2026-04-10T04:55:23.515216Z
Severity
  • 3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Nextcloud Deck vulnerable to authorization bypass
Details

Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Broken access control allows a user to delete attachments of other users. There are currently no known workarounds. It is recommended that the Nextcloud Deck app is upgraded to 1.6.5 or 1.7.3 or 1.8.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22471.json"
}
References

Affected packages

Git / github.com/nextcloud/deck

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/deck
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e9e55f8091a6ddfbc45a5b974722bfe3dcf77c0e
Database specific 
{
    "versions": [
        {
            "introduced": "1.60"
        },
        {
            "fixed": "1.6.5"
        }
    ]
}
Type
GIT
Repo
https://github.com/nextcloud/deck
Events
Introduced
5e3ddd83fc189b834de090fa8c6a8b52d5ef5a9e
Fixed
b158d794030b37060e02185d99f92f8882bcbe46
Database specific 
{
    "versions": [
        {
            "introduced": "1.7.0"
        },
        {
            "fixed": "1.7.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/nextcloud/deck
Events
Introduced
a9921ecdf00a276243f91513b92893df82da5f9a
Fixed
70fa18f1869eca3dca3abdf9ee15698c395473b9
Database specific 
{
    "versions": [
        {
            "introduced": "1.8.0"
        },
        {
            "fixed": "1.8.2"
        }
    ]
}

Affected versions

v0.*
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.1.4
v0.2.0
v0.2.1
v0.2.2
v0.3.0
v0.3.0-beta1
v0.3.1
v0.4.0
v0.4.0-beta1
v0.4.0-beta2
v0.4.0-beta3
v0.4.0-beta4
v0.4.0-beta5
v0.4.1
v0.5.0
v0.5.0-beta1
v0.5.0-rc1
v0.5.0-rc2
v0.5.1
v0.5.2
v0.6.0
v0.6.0-beta1
v0.6.0-beta2
v0.6.1
v0.6.2
v0.6.3
v0.6.4
v0.6.5
v0.6.6
v0.7.0
v0.8.0
v0.8.3
v1.*
v1.0.0
v1.0.0-beta1
v1.0.0-beta2
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.1.0-beta1
v1.1.0-beta2
v1.2.0
v1.2.0-beta1
v1.2.1
v1.2.2
v1.3.0-beta1
v1.3.0-beta2
v1.4.0
v1.6.0
v1.6.0-beta1
v1.6.0-beta2
v1.6.0-beta3
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.7.0
v1.7.1
v1.7.2
v1.8.0
v1.8.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-22471.json"