CVE-2023-7273 Cross Site Request Forgery in Kiteworks OwnCloud
An unauthenticated attacker can bypass CSRF checks to create administrator accounts via forged requests in Kiteworks OwnCloud.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-7273?
CVE-2023-7273 is a medium-severity vulnerability in Kiteworks OwnCloud, published on 1 Oct 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross site request forgery in Kiteworks OwnCloud allows an unauthenticated attacker to forge requests. If a request has no Authorization header, it is created with an empty string as value by a rewrite rule. The CSRF check is done by comparing the header value to null, meaning that the existing CSRF check is bypassed in this case. An attacker can, for example, create a new administrator account if the request is executed in the browser of an authenticated victim.
Weakness: CWE-352
Which versions are affected by CVE-2023-7273?
How do I fix CVE-2023-7273?
No fix has been published for CVE-2023-7273 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-7273 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-7273 exists.
Sources
Also known as GHSA-jmcc-268g-jp5g.