CVE-2023-25150

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-25150
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-25150.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-25150
Aliases
  • GHSA-64xc-r58v-53gj
Published
2023-02-08T20:15:24Z
Modified
2024-05-30T04:02:00.561189Z
Severity
  • 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Nextcloud office/richdocuments is an office suit for the nextcloud server platform. In affected versions the Collabora integration can be tricked to provide access to any file without proper permission validation. As a result any user with access to Collabora can obtain the content of other users files. It is recommended that the Nextcloud Office App (Collabora Integration) is updated to 7.0.2 (Nextcloud 25), 6.3.2 (Nextcloud 24), 5.0.10 (Nextcloud 23), 4.2.9 (Nextcloud 21-22), or 3.8.7 (Nextcloud 15-20). There are no known workarounds for this issue.

References

Affected packages

Git / github.com/nextcloud/richdocuments

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/richdocuments
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed

Affected versions

1.*

1.1.22
1.1.23
1.1.24
1.1.25
1.1.26
1.12.27
1.12.28
1.12.29
1.12.30
1.12.31
1.12.32
1.12.33
1.12.34
1.12.35
1.12.36
1.12.37
1.12.38
1.12.39
1.12.40

2.*

2.0.0
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9

3.*

3.4.0-beta1

Other

untagged-4ba473c037918af19928

v3.*

v3.0.0-beta1
v3.0.0-beta2
v3.0.0-beta3
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.2.2
v3.2.3
v3.2.4
v3.3.0
v3.3.1
v3.3.10
v3.3.11
v3.3.12
v3.3.13
v3.3.15
v3.3.2
v3.3.3
v3.3.4
v3.3.5
v3.3.6
v3.3.7
v3.3.8
v3.3.9
v3.4.0
v3.4.0-beta1
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v3.4.5
v3.4.6
v3.5.0
v3.5.1
v3.5.2
v3.6.0
v3.7.0
v3.7.0-beta1
v3.7.0-beta2
v3.7.0-beta3
v3.7.1
v3.7.10
v3.7.11
v3.7.12
v3.7.13
v3.7.14
v3.7.15
v3.7.16
v3.7.17
v3.7.18
v3.7.19
v3.7.2
v3.7.3
v3.7.4
v3.7.5
v3.7.6
v3.7.7
v3.7.8
v3.7.9
v3.8.0
v3.8.1
v3.8.2
v3.8.3
v3.8.4
v3.8.5
v3.8.6