CVE-2023-25159

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-25159
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-25159.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-25159
Aliases
  • GHSA-92g2-h5jv-jjmg
Published
2023-02-13T16:43:12.227Z
Modified
2026-08-12T03:51:34.469542910Z
Severity
  • 2.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Nextcloud Server previews are accessible without a watermark
Details

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Office is a document collaboration app for the same platform. Nextcloud Server 24.0.x prior to 24.0.8 and 25.0.x prior to 25.0.1, Nextcloud Enterprise Server 24.0.x prior to 24.0.8 and 25.0.x prior to 25.0.1, and Nextcloud Office (Richdocuments) App 6.x prior to 6.3.1 and 7.x prior to 7.0.1 have previews accessible without a watermark. The download should be hidden and the watermark should get applied. This issue is fixed in Nextcloud Server 25.0.1 and 24.0.8, Nextcloud Enterprise Server 25.0.1 and 24.0.8, and Nextcloud Office (Richdocuments) App 7.0.1 (for 25) and 6.3.1 (for 24). No known workarounds are available.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25159.json",
    "cwe_ids": [
        "CWE-284"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/nextcloud/richdocuments

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/richdocuments
Events
Introduced
ef21d975a612a34b7f82567de8b638388f71b337
Fixed
e633409c222c38d72c2e59923d0aa2d78fec7002
Introduced
fccb8fd3c492d2fdf53021d1f69d244bf9ad7f8d
Last affected
fccb8fd3c492d2fdf53021d1f69d244bf9ad7f8d
Database specific
Show details 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:nextcloud:richdocuments:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:nextcloud:richdocuments:7.0.0:-:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.3.1"
        },
        {
            "introduced": "7.0.0-NA"
        },
        {
            "last_affected": "7.0.0-NA"
        }
    ]
}
Type
GIT
Repo
https://github.com/nextcloud/server
Events
Introduced
fb9510ffed32c92dee60285157a69f09a10fe468
Fixed
888ffa498d3a08bb32591704806ee90075b4bc20
Introduced
20ea9a25353129b56d46951fe7d23939665ab2b2
Last affected
20ea9a25353129b56d46951fe7d23939665ab2b2
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "24.0.4"
        },
        {
            "fixed": "24.0.8"
        },
        {
            "introduced": "= 25.0.0"
        },
        {
            "last_affected": "= 25.0.0"
        }
    ]
}

Affected versions

24.*
24.0.2-NA
25.*
25.0.0
7.*
7.0.0-NA
= 25.*
= 25.0.0
= 7.*
= 7.0.0
v24.*
v24.0.4
v24.0.5
v24.0.5rc1
v24.0.6
v24.0.6rc1
v24.0.7
v24.0.7rc1
v24.0.8rc1
v24.0.8rc2
v25.*
v25.0.0
v6.*
v6.0.0
v6.1.0
v6.1.1
v6.2.0
v6.2.1
v6.3.0
v7.*
v7.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-25159.json"