CVE-2023-25150 Document content of files can be obtained through Collabora for files of other users
Attackers with Collabora access can read other users' file contents due to missing permission checks in the Nextcloud Office integration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-25150?
CVE-2023-25150 is a medium-severity missing authorization vulnerability in nextcloud security-advisories, published on 8 Feb 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Nextcloud office/richdocuments is an office suit for the nextcloud server platform. In affected versions the Collabora integration can be tricked to provide access to any file without proper permission validation. As a result any user with access to Collabora can obtain the content of other users files. It is recommended that the Nextcloud Office App (Collabora Integration) is updated to 7.0.2 (Nextcloud 25), 6.3.2 (Nextcloud 24), 5.0.10 (Nextcloud 23), 4.2.9 (Nextcloud 21-22), or 3.8.7 (Nextcloud 15-20). There are no known workarounds for this issue.
Which versions are affected by CVE-2023-25150?
It affects 1 product.
Products include Nextcloud Richdocuments.
How do I fix CVE-2023-25150?
No fix has been published for CVE-2023-25150 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-25150 being exploited?
There is no known exploitation of CVE-2023-25150 in the wild and no public exploit code.
Other vulnerabilities in nextcloud security-advisories
- CVE-2021-37628 File Drop can be bypassed using Richdocuments app in nextcloud
- CVE-2022-31024 Federated editing allows iframing remote servers by default in richdocuments
- CVE-2023-28645 Secure view can be bypassed by using internal API endpoint in Nextcloud richdocuments
- CVE-2021-37629 Lack of ratelimit on Richdocuments OCS endpoint in nextcloud
- CVE-2021-39223 File path disclosure of shared files in Richdocuments application
Sources
Also known as GHSA-64xc-r58v-53gj.