CVE-2023-35927

CVSS Score of 10 (low)

Details

Published Jun 23, 2023
Updated: Jul 5, 2023
CWE ID 284

Summary

CVE-2023-35927 is a vulnerability that affects NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2, as well as Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.o7, and 26.o.o2 when two servers are registered as trusted for each other and exchange share secrets successfully.The vulnerability allows a malicious server to modify or delete VCards in the system addressbook on the origin server, affecting the available and shown information in certain places like user search and avatar menu.However, if a manipulated user modifies their own data in the personal settings, the entry is fixed again.A patch is available in Nextcloud Server versions n25.o7 and n26.o2, as well as Nextcloud Enterprise Server versions n21.o9.n12, n22.n10.n12,n23.n12.n7,n24.n12.n2,n25.n7,and n26.n2.It is also possible to mitigate the risk by removing one of the servers from trusted status

Share

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-35927 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options