CVE-2023-48306

Summary

CVE-2023-48306 is a vulnerability affecting the Nextcloud Server, which is used for data storage in the open-source cloud platform Nextcloud. Versions 25.0.0 and prior to 25.0.11, as well as versions 22.0.0 and prior to 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server are impacted. The issue stems from a vulnerability in the DNS pin middleware, which can be exploited for DNS rebinding, allowing attackers to execute Server-Side Request Forgery (SSRF) attacks. Patches for the vulnerability are available in Nextcloud Server 25.0.11, 26.0.6, and 27.1.0, and Nextcloud Enterprise Server 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11, 26.0.6, and 27.1.0. No known workarounds are currently available.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.