CVE-2023-48304
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-48304
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-48304.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-48304
- Aliases
-
- GHSA-8jwv-c8c8-9fr3
- Published
- 2023-11-21T22:06:00Z
- Modified
- 2025-10-22T18:41:18.242746Z
- Severity
-
- 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
- Summary
- Nextcloud Server vulnerable to attacker enabling/disabling birthday calendar for any user
- Details
-
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in version 22.0.0 and prior to versions 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Enterprise Server, an attacker could enable and disable the birthday calendar for any user on the same server. Nextcloud Server 25.0.11, 26.0.6, and 27.1.0 and Nextcloud Enterprise Server 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11, 26.0.6, and 27.1.0 contain patches for this issue. No known workarounds are available.
- Database specific
{ "cwe_ids": [ "CWE-639" ] }- References
Affected packages
Git / github.com/nextcloud/server
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nextcloud/server
- Events
- Type
- GIT
- Repo
- https://github.com/nextcloud/server
- Events
- Type
- GIT
- Repo
- https://github.com/nextcloud/server
- Events
Affected versions
v25.*
v25.0.0
v25.0.1
v25.0.10
v25.0.10rc1
v25.0.11rc1
v25.0.1rc1
v25.0.2
v25.0.2rc1
v25.0.2rc2
v25.0.2rc3
v25.0.3
v25.0.3rc1
v25.0.3rc2
v25.0.4
v25.0.4rc1
v25.0.5
v25.0.5rc1
v25.0.6
v25.0.6rc1
v25.0.7
v25.0.7rc1
v25.0.8
v25.0.8rc1
v25.0.8rc2
v25.0.9
v25.0.9rc1
v25.0.9rc2
v26.*
v26.0.0
v26.0.1
v26.0.1rc1
v26.0.2
v26.0.2rc1
v26.0.3
v26.0.3rc1
v26.0.3rc2
v26.0.4
v26.0.4rc1
v26.0.4rc2
v26.0.5
v26.0.5rc1
v26.0.6rc1
v27.*
v27.0.0
v27.0.1
v27.0.1rc1
v27.0.1rc2
v27.0.2
v27.0.2rc1
v27.1.0beta2
v27.1.0beta3
v27.1.0rc1
v27.1.0rc2
v27.1.0rc3
v27.1.0rc4