CVE-2023-30539 Users can set up workflows using restricted and invisible system tags in Nextcloud
Attackers can bypass access controls by using restricted system tags in workflows, potentially granting unauthorized access to files.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-30539?
CVE-2023-30539 is a medium-severity missing authorization vulnerability in Nextcloud Nextcloud Server, published on 17 Apr 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Nextcloud is a personal home server system. Depending on the set up tags and other workflows this issue can be used to limit access of others or being able to grant them access when there are system tag based files access control or files retention rules. It is recommended that the Nextcloud Server is upgraded to 24.0.11 or 25.0.5, the Nextcloud Enterprise Server to 21.0.9.11, 22.2.10.11, 23.0.12.6, 24.0.11 or 25.0.5, and the Nextcloud Files automated tagging app to 1.11.1, 1.12.1, 1.13.1, 1.14.2, 1.15.3 or 1.16.1. Users unable to upgrade should disable all workflow related apps. Users are advised to upgrade.
Weakness: CWE-284
Which versions are affected by CVE-2023-30539?
It affects 2 products.
Products include Nextcloud Nextcloud Files Automated Tagging, Nextcloud Nextcloud Server.
How do I fix CVE-2023-30539?
No fix has been published for CVE-2023-30539 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-30539 being exploited?
There is no known exploitation of CVE-2023-30539 in the wild and no public exploit code.
Sources
Also known as GHSA-3m2f-v8x7-9w99.