CVE-2023-22469CWE-922

Nextcloud Deck card vulnerable to data leak to unauthorized users via reference preview cache

Medium · published January 10, 2023

CVSS v3.1
5.8
EPSS
1%
Percentile
52.9
In the wild
Unconfirmed
What it is

Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. When getting the reference preview for Deck cards the user has no access to, unauthorized user could eventually get the cached data of a user that has access. There are currently no known workarounds. It is recommended that the Nextcloud app Deck is upgraded to 1.8.2.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00707 · 52.9th percentile
Weakness
CWE-922 · Insecure Storage of Sensitive Information
Published
2023-01-10T20:26Z
EPSS history
Timeline
  • 10 JAN 20:26Z
    Nextcloud Deck card vulnerable to data leak to unauthorized users via reference preview cache
    cvelistv5