CVE
CVE-2023-49105
An issue was discovered in ownCloud owncloud/core before 10.13.1.
An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.
Package Versions Affected
Package Version
patch Availability
No items found.
Automatically patch vulnerabilities without upgrading
Fix Without Upgrading
Detect compatible fix
Apply safe remediation
Fix with a single pull request
CVSS Version
Severity
Base Score
CVSS Version
Score Vector
C
H
U
9.8
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
C
H
U
0
-
3.1
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
C
H
U
-
Related Resources
No items found.
References
https://owncloud.org/security, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49105.json, https://nvd.nist.gov/vuln/detail/CVE-2023-49105, https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/