CVE-2023-25817CWE-281

Delete permissions are not saved when creating public share in Nextcloud server

Low · published March 27, 2023

CVSS v3.1
3.5
EPSS
1%
Percentile
46.1
In the wild
Unconfirmed
What it is

Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their permissions to delete files they were not supposed to deletable but only viewed or downloaded. This issue has been addressed andit is recommended that the Nextcloud Server is upgraded to 24.0.9. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00564 · 46.1th percentile
Weakness
CWE-281 · Improper Preservation of Permissions
Published
2023-03-27T20:04Z
EPSS history
Timeline
  • 27 MAR 20:04Z
    Delete permissions are not saved when creating public share in Nextcloud server
    cvelistv5