CVE-2023-25150

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-25150
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-25150.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-25150
Aliases
  • GHSA-64xc-r58v-53gj
Published
2023-02-08T19:15:47.344Z
Modified
2026-04-10T04:55:58.990503Z
Severity
  • 5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N CVSS Calculator
Summary
Document content of files can be obtained through Collabora for files of other users
Details

Nextcloud office/richdocuments is an office suit for the nextcloud server platform. In affected versions the Collabora integration can be tricked to provide access to any file without proper permission validation. As a result any user with access to Collabora can obtain the content of other users files. It is recommended that the Nextcloud Office App (Collabora Integration) is updated to 7.0.2 (Nextcloud 25), 6.3.2 (Nextcloud 24), 5.0.10 (Nextcloud 23), 4.2.9 (Nextcloud 21-22), or 3.8.7 (Nextcloud 15-20). There are no known workarounds for this issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25150.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-284"
    ]
}
References

Affected packages

Git / github.com/nextcloud/richdocuments

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/richdocuments
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7ffc2ad4cb6cd16d61186cc2dbb9bad16f4c78fb
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.8.7"
        }
    ]
}
Type
GIT
Repo
https://github.com/nextcloud/richdocuments
Events
Introduced
920fc643722b23fae8972ddc166c144e422ae575
Fixed
91ebe263d5ff3180fa851b9bebe046652a0f310e
Database specific 
{
    "versions": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.2.9"
        }
    ]
}
Type
GIT
Repo
https://github.com/nextcloud/richdocuments
Events
Introduced
6d751c16b609a433c83d9d61585a98efc050260d
Fixed
6012c44fad54d67624ca91707770808caed0cc80
Database specific 
{
    "versions": [
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.0.10"
        }
    ]
}
Type
GIT
Repo
https://github.com/nextcloud/richdocuments
Events
Introduced
ef21d975a612a34b7f82567de8b638388f71b337
Fixed
c92d2e8cd23b8887a91d72094c7fb6e75ea85ddd
Database specific 
{
    "versions": [
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.3.2"
        }
    ]
}
Type
GIT
Repo
https://github.com/nextcloud/richdocuments
Events
Introduced
fccb8fd3c492d2fdf53021d1f69d244bf9ad7f8d
Fixed
af719798f1481950c54ad76bff0eb90a59b04cb6
Database specific 
{
    "versions": [
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.0.2"
        }
    ]
}

Affected versions

1.*
1.1.22
1.1.23
1.1.24
1.1.25
1.1.26
1.12.27
1.12.28
1.12.29
1.12.30
1.12.31
1.12.32
1.12.33
1.12.34
1.12.35
1.12.36
1.12.37
1.12.38
1.12.39
1.12.40
2.*
2.0.0
2.0.1
2.0.10
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.*
3.4.0-beta1
Other
untagged-4ba473c037918af19928
v3.*
v3.0.0-beta1
v3.0.0-beta2
v3.0.0-beta3
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.1.0
v3.1.1
v3.2.1
v3.2.2
v3.2.3
v3.2.4
v3.3.0
v3.3.1
v3.3.10
v3.3.11
v3.3.12
v3.3.13
v3.3.15
v3.3.2
v3.3.3
v3.3.4
v3.3.5
v3.3.6
v3.3.7
v3.3.8
v3.3.9
v3.4.0
v3.4.0-beta1
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v3.4.5
v3.4.6
v3.5.0
v3.5.1
v3.5.2
v3.6.0
v3.7.0
v3.7.0-beta1
v3.7.0-beta2
v3.7.0-beta3
v3.7.1
v3.7.10
v3.7.11
v3.7.12
v3.7.13
v3.7.14
v3.7.15
v3.7.16
v3.7.17
v3.7.18
v3.7.19
v3.7.2
v3.7.3
v3.7.4
v3.7.5
v3.7.6
v3.7.7
v3.7.8
v3.7.9
v3.8.0
v3.8.1
v3.8.2
v3.8.3
v3.8.4
v3.8.5
v3.8.6
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.0.4
v4.1.0
v4.1.1
v4.1.2
v4.2.1
v4.2.2
v4.2.3
v4.2.4
v4.2.5
v4.2.6
v4.2.7
v4.2.8
v5.*
v5.0.0
v5.0.1
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v5.0.6
v5.0.7
v5.0.8
v5.0.9
v6.*
v6.0.0
v6.1.0
v6.1.1
v6.2.0
v6.2.1
v6.3.0
v6.3.1
v7.*
v7.0.0
v7.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-25150.json"